Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-11352

QUIC zero-length UDP datagrams busy-loop

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
curl

Description

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

curl curl

Default version status: unaffected

  • 8.18.0 to < 8.20.1affected

curl curl

Default version status: unaffected

  • 6a3d0b6d631d5e9bec797306b5b41a9f440a088d to < 56eca2afb4806f1032872fa97d1834b3c1385276affected

curl curl

Default version status: unaffected

  • 8.20.0affected
  • 8.19.0affected
  • 8.18.0affected

References