At this point that's not unexpected. Given the proliferation of tools generally, if not freely, available, it would be naive to think that the published PoC was the only one in existence.
As a result, the curl project has just changed their CVE policy to publish all with a severity less than HIGH, starting 26 October.
See: