curl QUIC UDP Denial of Service Vulnerability

Executive Summary

CVE-2026-11352 is a vulnerability in curl's QUIC UDP receive function that allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client.

The issue arises because a helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget. This enables a connected QUIC peer to continuously send empty datagrams, causing the client to stall indefinitely by entering an infinite loop.

This flaw affects curl versions 8.18.0 to 8.20.0 and platforms that use the recvmmsg() function call. It was fixed in curl version 8.21.0.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service (DoS) condition on affected curl or libcurl clients.

A malicious HTTP/3 server can exploit this issue by sending continuous zero-length UDP datagrams, which stalls the client indefinitely and prevents it from functioning properly.

This can disrupt applications or services relying on curl or libcurl for HTTP/3 communication, potentially leading to service unavailability or degraded performance.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, the curl project recommends upgrading to curl version 8.21.0, which contains the fix.

Alternatively, you can apply the patch provided for this issue and rebuild your current curl version.

Another immediate mitigation is to avoid using HTTP/3, which is the protocol involved in triggering this denial of service.

Useful 0 Not Useful 0