GHSA-qxwx-hr5v-h5q4
A vulnerability in curl's QUIC UDP receive function allows a malicious HTTP/3 server to cause a remote denial of service (DoS) against curl or libcurl clients. The issue arises because zero-length UDP datagrams are discarded before counting toward the packet budget, enabling a connected QUIC peer to continuously send empty datagrams and stall the client indefinitely.
AI Analysis
Technical Summary
CVE-2026-11352 describes a denial of service vulnerability in curl's QUIC UDP receive function. Specifically, the helper function handling UDP datagrams discards zero-length packets without counting them against the per-call packet budget. This flaw allows a malicious HTTP/3 server acting as a connected QUIC peer to stream empty UDP datagrams continuously, effectively stalling the client indefinitely and causing a remote denial of service condition.
Potential Impact
An attacker controlling an HTTP/3 server can remotely cause curl or libcurl clients to stall indefinitely by exploiting the improper handling of zero-length UDP datagrams in the QUIC receive function. This results in a denial of service against the affected client, potentially disrupting applications relying on curl or libcurl for HTTP/3 communications.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when connecting to untrusted HTTP/3 servers. No vendor advisory or patch links are currently provided.
GHSA-qxwx-hr5v-h5q4
Description
A vulnerability in curl's QUIC UDP receive function allows a malicious HTTP/3 server to cause a remote denial of service (DoS) against curl or libcurl clients. The issue arises because zero-length UDP datagrams are discarded before counting toward the packet budget, enabling a connected QUIC peer to continuously send empty datagrams and stall the client indefinitely.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-11352 describes a denial of service vulnerability in curl's QUIC UDP receive function. Specifically, the helper function handling UDP datagrams discards zero-length packets without counting them against the per-call packet budget. This flaw allows a malicious HTTP/3 server acting as a connected QUIC peer to stream empty UDP datagrams continuously, effectively stalling the client indefinitely and causing a remote denial of service condition.
Potential Impact
An attacker controlling an HTTP/3 server can remotely cause curl or libcurl clients to stall indefinitely by exploiting the improper handling of zero-length UDP datagrams in the QUIC receive function. This results in a denial of service against the affected client, potentially disrupting applications relying on curl or libcurl for HTTP/3 communications.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when connecting to untrusted HTTP/3 servers. No vendor advisory or patch links are currently provided.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qxwx-hr5v-h5q4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-11352"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a483cb627e9c79719d82120
Added to database: 07/03/2026, 22:50:30 UTC
Last enriched: 07/03/2026, 23:04:04 UTC
Last updated: 07/04/2026, 01:54:15 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.