{"id":"ALPINE-CVE-2026-11352","details":"An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server\nto trigger a remote denial of service against a curl or libcurl client.\nBecause the helper function discards zero-length UDP datagrams before counting\nthem toward the per-call packet budget, a connected QUIC peer can continuously\nstream empty datagrams to indefinitely stall the client.","modified":"2026-09-04T17:30:02.427908303Z","published":"2026-07-03T07:16:23.693Z","upstream":["CVE-2026-11352"],"references":[{"type":"ADVISORY","url":"https://security.alpinelinux.org/vuln/CVE-2026-11352"}],"affected":[{"package":{"name":"curl","ecosystem":"Alpine:v3.23","purl":"pkg:apk/alpine/curl?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.18.0"},{"fixed":"8.22.0-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2026-11352.json"}},{"package":{"name":"curl","ecosystem":"Alpine:v3.24","purl":"pkg:apk/alpine/curl?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.18.0"},{"fixed":"8.21.0-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2026-11352.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}