Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-03T06:12:10 curl: libcurl: curl/libcurl: Remote denial of service via QUIC UDP receive function vulnerability 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-835

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.

A flaw was found in curl and libcurl. A malicious HTTP/3 server can exploit an issue in the QUIC UDP receive function by continuously streaming empty UDP datagrams. This can lead to a remote denial of service (DoS) against a curl or libcurl client, as the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, causing the client to indefinitely stall.

This Important flaw in curl and libcurl allows a remote malicious HTTP/3 server to trigger a denial of service against a client. By continuously sending zero-length UDP datagrams, an attacker can indefinitely stall the client, impacting service availability without requiring authentication or user interaction. This poses a significant risk to applications relying on curl for HTTP/3 communication. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Hardened Images 2026-06-24T00:00:00Z RHSA-2026:29017 curl-main-8.21.0-0.1.hum1 Red Hat Hardened Images 2026-07-02T00:00:00Z RHSA-2026:34975 rust-main-1.96.1-1.hum1 Red Hat Enterprise Linux 10 Affected curl Red Hat Enterprise Linux 6 Affected curl Red Hat Enterprise Linux 7 Affected curl Red Hat Enterprise Linux 8 Affected curl Red Hat Enterprise Linux 8 Not affected dotnet8.0 Red Hat Enterprise Linux 9 Affected curl Red Hat JBoss Core Services Affected libcurl-1.dll Red Hat JBoss Core Services Affected libcurl.so Red Hat OpenShift Container Platform 4 Affected rhcos Red Hat OpenShift Dev Spaces Affected devspaces/code-rhel9 Red Hat Trusted Profile Analyzer Affected rhtpa/rhtpa-trustification-service-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-11352 https://nvd.nist.gov/vuln/detail/CVE-2026-11352 https://curl.se/docs/CVE-2026-11352.html https://curl.se/docs/CVE-2026-11352.json https://hackerone.com/reports/3783438