The bogus CVE problem

> His example in that case is a double-free in curl that the project determined had a "medium" severity, while NVD scored it as "9.8 critical", as can be seen in the GitHub advisory database.

Is there anything special about this "double-free" making this just a medium?

Depends on the malloc implementation, double-free can corrupt data. In a library like curl, this can have very bad consequence.. A "high" score is well justified.