Need confirmation for some unpatched CVE in Curl

I'm cloning this repo to make some modifications to customize. However, I've noticed that some CVEs which were confirmed and fixed by curl do not get patched in this repo. To enhance the availability of my project as far as possible, I will appreciate it if any of the CVE below do exist in this repo as well, so that I can fix these security issue myself by applying the corresponding patch.
Here are the CVEs I found in this repo unpatched, but get fixed in curl:

CVE-2018-1000121 in contrib/curl/lib/openldap.c's function static ssize_t ldap_recv(struct connectdata *conn, int sockindex, char *buf, size_t len, CURLcode *err), with patch here for your reference.

CVE-2018-16890 in contrib/curl/lib/vauth/ntlm.c's function static CURLcode ntlm_decode_type2_target(struct Curl_easy *data, unsigned char *buffer, size_t size, struct ntlmdata *ntlm), with patch here for your reference.

CVE-2018-1000122 in contrib/curl/lib/transfer.c's function static CURLcode readwrite_data(struct Curl_easy *data, struct connectdata *conn, struct SingleRequest *k, int *didwhat, bool *done, bool *comeback), with patch here for your reference.

Compare the bundled files contrib/curl/lib/openldap.c, contrib/curl/lib/vauth/ntlm.c, and contrib/curl/lib/transfer.c with the linked upstream curl commits. Check whether each CVE applies to this vendored version, then verify the corresponding changes and any available project checks.