curl QUIC UDP Denial of Service Vulnerability

Executive Summary

CVE-2026-11352 is a vulnerability in curl's QUIC UDP receive function that allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client.

The issue arises because a helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget. This enables a connected QUIC peer to continuously send empty datagrams, causing the client to stall indefinitely by entering an infinite loop.

This flaw affects curl versions 8.18.0 to 8.20.0 and platforms that use the recvmmsg() function call. It was fixed in curl version 8.21.0.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a denial of service caused by a malicious HTTP/3 server sending zero-length UDP datagrams to a curl or libcurl client, causing the client to stall.

To detect this vulnerability on your system, you can check the version of curl installed to see if it falls within the affected range (versions 8.18.0 to 8.20.0).

• Run `curl --version` to determine the installed curl version.

If you want to monitor network traffic for suspicious zero-length UDP datagrams from HTTP/3 servers, you can use packet capture tools like tcpdump or Wireshark.

• Use `sudo tcpdump -i <interface> udp and port <quic-port>` to capture UDP traffic on the QUIC port.
• Analyze captured packets for zero-length UDP datagrams which may indicate an attempt to exploit this vulnerability.

Since the vulnerability is triggered by continuous zero-length UDP datagrams, monitoring for an unusual volume of such packets from a single HTTP/3 server could help detect exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service (DoS) condition on affected curl or libcurl clients.

A malicious HTTP/3 server can exploit this issue by sending continuous zero-length UDP datagrams, which stalls the client indefinitely and prevents it from functioning properly.

This can disrupt applications or services relying on curl or libcurl for HTTP/3 communication, potentially leading to service unavailability or degraded performance.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, the curl project recommends upgrading to curl version 8.21.0, which contains the fix.

Alternatively, you can apply the patch provided for this issue and rebuild your current curl version.

Another immediate mitigation is to avoid using HTTP/3, which is the protocol involved in triggering this denial of service.

Useful 0 Not Useful 0