CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop
An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.74.0-1.3+deb11u13Fixed in 7.74.0-1.3+deb11u16Fixed in 7.88.1-10+deb12u14Fixed in 7.88.1-10+deb12u5Fixed in 8.14.1-2+deb13u3Fixed in 8.21.0-2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11352?
CVE-2026-11352 has a risk rating of 28, indicating a significant impact.
How do I fix CVE-2026-11352?
To fix CVE-2026-11352, you should update to the latest version of curl or libcurl that addresses this vulnerability.
What software is affected by CVE-2026-11352?
CVE-2026-11352 affects curl and libcurl clients that utilize QUIC.
What type of vulnerability is CVE-2026-11352?
CVE-2026-11352 is a remote denial of service vulnerability caused by handling zero-length UDP datagrams.
How can CVE-2026-11352 be exploited?
An attacker can exploit CVE-2026-11352 by sending zero-length UDP datagrams from a malicious HTTP/3 server to cause a busy loop in the client.