I haven't looked at the code, but could we preserve the existing behavior but apply a timeout to mitigate the DOS?

On the other hand, the fact that curl manages to return something indicates there is probably an error recovery strategy that would work.  I'm not sure if we have an error reporting mechanism in httplib if we do error recovery.  We do in the email module, and httplib uses the email code for headers, I think, so there might be a way to leverage that if there is no existing mechanism.  But of course even deciding to do that requires some discussion :)