Every CVE Search/ Get API key

CVE-2026-11352

QUIC zero-length UDP datagrams busy-loop

7.5 HighFix available

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.01%Up 0.7 points since Jul 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

QUIC zero-length UDP datagrams busy-loop

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.

Record
CVE-2026-11352
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
EUVDEUVD-2026-41498 7.5

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.

Record
EUVD-2026-41498
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-qxwx-hr5v-h5q4 7.5

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote...

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.

Record
GHSA-qxwx-hr5v-h5q4
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
NVD 7.5

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.

Record
CVE-2026-11352
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
OSVALPINE-CVE-2026-11352 7.5

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.

Record
ALPINE-CVE-2026-11352
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2026-11352 7.5
Record
BELL-CVE-2026-11352
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 10 moreShow less
OSV 7.5

QUIC zero-length UDP datagrams busy-loop

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.

Record
CVE-2026-11352
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-03
OSVDEBIAN-CVE-2026-11352 7.5

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.

Record
DEBIAN-CVE-2026-11352
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVJLSEC-2026-1198 7.5

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote...

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.

Record
JLSEC-2026-1198
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:29017 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:29017
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:34975 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:34975
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-11352 7.5

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.

Record
UBUNTU-CVE-2026-11352
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCURL-CVE-2026-11352 No score

QUIC zero-length UDP datagrams busy-loop

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.

Record
CURL-CVE-2026-11352
Updated
2026-11-02
OSVopenSUSE-SU-2026:11230-1 No score

curl-8.21.0-1.1 on GA media

These are all security issues fixed in the curl-8.21.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11230-1
Updated
2026-11-02
OSVSUSE-SU-2026:5068-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
  • CVE-2026-9546: sending old referer (bsc#1268419).
  • CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
  • CVE-2026-11564: Native CA trust persist (bsc#1268424).
  • CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
  • CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
  • CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
  • CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
  • CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
  • CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
  • CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
  • CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
  • CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
  • CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
  • CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
  • CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
  • CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
  • CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
  • CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
  • CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
  • CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
  • CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
  • CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
  • CVE-2026-92389: TFTP direction confusion (bsc#1285015).
  • CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
  • CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
  • CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
  • CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
  • CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
  • CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

Changes for curl:

  • Updated curl to version 8.22.0. (jsc#PED-16984)
Record
SUSE-SU-2026:5068-1
Updated
2026-11-03
OSVSUSE-SU-2026:5069-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
  • CVE-2026-9546: sending old referer (bsc#1268419).
  • CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
  • CVE-2026-11564: Native CA trust persist (bsc#1268424).
  • CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
  • CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
  • CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
  • CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
  • CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
  • CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
  • CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
  • CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
  • CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
  • CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
  • CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
  • CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
  • CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
  • CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
  • CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
  • CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
  • CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
  • CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
  • CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
  • CVE-2026-92389: TFTP direction confusion (bsc#1285015).
  • CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
  • CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
  • CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
  • CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
  • CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
  • CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

Changes for curl:

  • Updated to version 8.22.0. (jsc#PED-16984)
Record
SUSE-SU-2026:5069-1
Updated
2026-11-03

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Alpine:v3.23
 8.18.0 up to 8.22.0-r0
8.22.0-r0
curl
Alpine:v3.24
 8.18.0 up to 8.21.0-r0
8.21.0-r0
curl
Alpaquita:23
 8.1.0-r2 up to 8.21.0-r0
8.21.0-r0
curl
Alpaquita:25
 8.14.0-r1 up to 8.21.0-r0
8.21.0-r0
curl
Alpaquita:stream
 8.1.2-r0 up to 8.21.0-r0
8.21.0-r0
curl
BellSoft Hardened Containers:stream
 8.1.2-r0 up to 8.21.0-r0
8.21.0-r0
curl
Debian:14
 before 8.21.0~rc2-1, plus listed versions
8.14.1-28.14.1-2+exp18.15.0-18.15.0-1~bpo13+18.15.0-1~exp1
Show 45 moreShow less
8.15.0~rc1-1exp18.15.0~rc2-1~exp18.15.0~rc3-1~exp18.16.0-18.16.0-1+exp18.16.0-1~bpo13+18.16.0-28.16.0-38.16.0-48.16.0-4~bpo13+18.16.0~rc1-1~exp18.16.0~rc2-18.16.0~rc2-28.16.0~rc3-18.17.0-18.17.0-28.17.0-38.17.0~rc1-1~exp18.17.0~rc2-18.17.0~rc3-18.18.0-18.18.0-1~bpo13+18.18.0-28.18.0~rc1-1+exp18.18.0~rc2-18.18.0~rc3-18.19.0-18.19.0-1+exp18.19.0-1~bpo13+18.19.0-28.19.0-38.19.0-3+exp18.19.0-3+exp28.19.0~rc1-1~exp18.19.0~rc2-18.19.0~rc2-28.19.0~rc3-18.20.0-18.20.0-1+exp8.20.0-28.20.0-2+exp18.20.0-2~bpo13+18.20.0-38.20.0-48.20.0-5
8.21.0~rc2-1
CURL_jll
Julia
 8.20.0+0 up to 8.21.0+0
8.21.0+0
LibCURL_jll
Julia
 8.18.0+0 up to 8.21.0+0
8.21.0+0
curl
Red Hat:hummingbird:1
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
Show 27 moreShow less
Affected packages
PackageAffectedFixed
libcurl
Red Hat:hummingbird:1
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
libcurl-devel
Red Hat:hummingbird:1
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
libcurl-minimal
Red Hat:hummingbird:1
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
cargo
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
clippy
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-analyzer
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-debugger-common
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-doc
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-gdb
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-lldb
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-src
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-aarch64-unknown-none-softfloat
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-aarch64-unknown-uefi
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-i686-pc-windows-gnu
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-wasm32-unknown-unknown
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-wasm32-wasip1
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-x86_64-pc-windows-gnu
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-x86_64-unknown-none
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-x86_64-unknown-uefi
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rustfmt
Red Hat:hummingbird:1
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
curl
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 8.22.0-150700.7.33.1
8.22.0-150700.7.33.1
curl
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 8.22.0-150600.4.58.1
8.22.0-150600.4.58.1
curl
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 8.22.0-150600.4.58.1
8.22.0-150600.4.58.1
curl
Ubuntu:26.04:LTS
 before 8.18.0-1ubuntu2.3, plus listed versions
8.14.1-2ubuntu18.17.0-1ubuntu18.18.0-1ubuntu18.18.0-1ubuntu28.18.0-1ubuntu2.18.18.0-1ubuntu2.2
8.18.0-1ubuntu2.3
curl
openSUSE:Tumbleweed
 before 8.21.0-1.1
8.21.0-1.1

History

History
RecordedChangedSources
affected, aliases, facts, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-11352 is a high vulnerability (CVSS 7.5) in Curl, published June 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.01%, the 63rd percentile. Fixed in curl 8.22.0-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 9 versions and 67 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open