[Bug Report]: Need confirmation for unpatched CVE

### Contact Details

18302010006@fudan.edu.cn

### What happened?

I'm cloning this repo to make some modifications to customize. However, I've noticed that a CVE which were confirmed and fixed by [curl](https://github.com/curl/curl) do not get patched in this repo. To enhance the availability of my project as far as possible, I will appreciate it if any of the CVE below do exist in this repo as well, so that I can fix these security issue myself by applying the corresponding patch.
Here is the CVE I found in this repo unpatched, but get fixed in [curl](https://github.com/curl/curl):

CVE-2022-32206 in [components/curl/lib/content_encoding.c](https://github.com/alibaba/AliOS-Things/blob/master/components/curl/lib/content_encoding.c#L939)'s function `CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
const char *enclist, int maybechunked)`, with [patch](https://github.com/curl/curl/commit/3a09fbb7f264c67c438d01a30669ce325aa508e2) here for your reference.

### Version

master (Default)

### What soultions are you seeing the problem on?

_No response_

### Relevant log output

_No response_

Start with components/curl/lib/content_encoding.c and Curl_build_unencoding_stack, then compare the bundled code with curl's CVE-2022-32206 fix in commit 3a09fbb7f264c67c438d01a30669ce325aa508e2. Done means confirming whether the vulnerability exists in this repository and documenting or applying the corresponding fix; no test file is named.

Written by the indexing model from the issue text.