CVE-2026-11352

HIGH 7.5

QUIC zero-length UDP datagrams busy-loop

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.

CWE	CWE-835
Vendor	curl
Product	curl
Published	Jul 3, 2026
Last Updated	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for curl curl

Be the first to know when new high vulnerabilities affecting curl curl are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

curl / curl

8.18.0 < 8.20.1

curl / curl

6a3d0b6d631d5e9bec797306b5b41a9f440a088d < 56eca2afb4806f1032872fa97d1834b3c1385276

curl / curl

8.20.0 8.19.0 8.18.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

curl.se: https://curl.se/docs/CVE-2026-11352.json curl.se: https://curl.se/docs/CVE-2026-11352.html hackerone.com: https://hackerone.com/reports/3783438

Credits

vectorqueue on hackerone (AntAISecurityLab) Stefan Eissing