{"id":"CVE-2026-11352","summary":"QUIC zero-length UDP datagrams busy-loop","details":"An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server\nto trigger a remote denial of service against a curl or libcurl client.\nBecause the helper function discards zero-length UDP datagrams before counting\nthem toward the per-call packet budget, a connected QUIC peer can continuously\nstream empty datagrams to indefinitely stall the client.","aliases":["CURL-CVE-2026-11352"],"modified":"2026-11-03T22:57:08.228340548Z","published":"2026-07-03T06:12:10.777Z","related":["SUSE-SU-2026:5068-1","SUSE-SU-2026:5069-1","openSUSE-SU-2026:11230-1"],"database_specific":{"cna_assigner":"curl","cwe_ids":["CWE-835"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11352.json"},"references":[{"type":"WEB","url":"https://curl.se/docs/CVE-2026-11352.html"},{"type":"WEB","url":"https://curl.se/docs/CVE-2026-11352.json"},{"type":"WEB","url":"https://hackerone.com/reports/3783438"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11352.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11352"},{"type":"PACKAGE","url":"https://github.com/curl/curl.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/curl/curl","events":[{"introduced":"2eebc58c4b8d68c98c8344381a9f6df4cca838fd"},{"fixed":"68720b4837284335b2d63cb358f8f6ce65f5bc55"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"8.18.0"},{"fixed":"8.21.0"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"}]}},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"6a3d0b6d631d5e9bec797306b5b41a9f440a088d"},{"fixed":"56eca2afb4806f1032872fa97d1834b3c1385276"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"6a3d0b6d631d5e9bec797306b5b41a9f440a088d"},{"fixed":"56eca2afb4806f1032872fa97d1834b3c1385276"}],"source":"AFFECTED_FIELD"}]}}],"versions":["8.18.0","8.19.0","8.20.0","rc-8_21_0-3","rc-8_21_0-2","rc-8_21_0-1","curl-8_20_0","rc-8_20_0-3","rc-8_20_0-2","rc-8_20_0-1","curl-8_19_0","curl-8_18_0","rc-8_19_0-3","rc-8_19_0-2","rc-8_19_0-1","rc-8_18_0-3"],"database_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/56eca2afb4806f1032872fa97d1834b3c1385276","target":{"file":"lib/vquic/vquic.c"},"deprecated":false,"digest":{"line_hashes":["8724453169819657302314774805657094082","261317499416676525855372847859961638644","292487107086365306031949868405637843668","309311828468822053510859394110150196214","31135108115463552048891152615770408904","57915329002755719217061593695510132297","56509348555510414857213222953972427758","31559790585369494778485528927910483629","197903950728067412386560788602144590888","87962793772792683778074868188172170356"],"threshold":0.9},"id":"CVE-2026-11352-0410a26e"},{"id":"CVE-2026-11352-71d42987","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/56eca2afb4806f1032872fa97d1834b3c1385276","target":{"file":"lib/vquic/vquic.c","function":"recvmsg_packets"},"deprecated":false,"digest":{"length":1810,"function_hash":"92915703145574751170747784747814977008"}},{"source":"https://github.com/curl/curl.git/commit/56eca2afb4806f1032872fa97d1834b3c1385276","target":{"function":"recvmmsg_packets","file":"lib/vquic/vquic.c"},"deprecated":false,"digest":{"function_hash":"112665705993807998852020689214883065967","length":2733},"id":"CVE-2026-11352-cae54271","signature_type":"Function","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-24T14:18:28Z","source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-11352.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}