CVE-2026-11352 Details
Description
An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.
A remote denial-of-service vulnerability has been identified in curl's QUIC UDP receive function. This issue allows a malicious HTTP/3 server to stall a connected curl or libcurl client indefinitely by sending empty UDP datagrams. The vulnerability affects curl versions 8.18.0 prior to 8.21.0, and was introduced in version 8.18.0. The problem arises because the receive function discards zero-length datagrams before they count towards the packet budget, enabling the server to flood the client with empty packets and disrupt normal operation.
Users are advised to upgrade curl and libcurl to version 8.21.0 or later. The vulnerability can also be patched by applying the fix available in the curl GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackerone.com/reports/3783438 | CISA-ADP | ExploitIssue TrackingThird Party Advisory |
| https://curl.se/docs/CVE-2026-11352.html | curl | PatchVendor Advisory |
| https://curl.se/docs/CVE-2026-11352.json | curl | Vendor Advisory |
| https://hackerone.com/reports/3783438 | curl | ExploitIssue TrackingThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | curl |
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 8.18.0, < 8.21.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | curl |
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 3, 2026 | New CVE Received | curl |