CVE-2026-11352: curl QUIC DoS Vulnerability – Remote Client Stall

Technical summary

CVE-2026-11352 is a denial-of-service vulnerability in curl's QUIC protocol implementation affecting the UDP receive function. The vulnerability stems from the library's handling of zero-length UDP datagrams in the packet receive loop. The vulnerable code discards zero-length packets before applying them against the per-call packet budget limit. A connected QUIC peer can exploit this by continuously transmitting empty datagrams, bypassing the budget mechanism and causing the receive function to loop indefinitely, consuming CPU cycles and blocking the client application. The issue resides in the QUIC transport layer implementation and affects HTTP/3 functionality.

Business impact

Organizations deploying curl or libcurl clients that connect to untrusted or compromised HTTP/3 servers face availability risk. Client applications—including download tools, API clients, container image pullers, and other automation—can be rendered unresponsive by a remote attacker, disrupting workflows and service availability. The impact scales with the number of concurrent curl clients; a single malicious server can affect many simultaneous connections. However, exploitation requires the client to connect to a server controlled by the attacker, limiting the blast radius in most network architectures.

Affected systems

All versions of curl and libcurl with HTTP/3 (QUIC) support are affected. This includes standalone curl binaries and any application statically or dynamically linked against vulnerable libcurl. The vulnerability is specific to HTTP/3 connections; HTTP/1.1 and HTTP/2 traffic is not impacted. Affected environments include development machines, CI/CD pipelines, container orchestration systems, and any server or client infrastructure relying on curl for QUIC-enabled downloads or API calls.

Exploitability

Exploitation requires network access and the ability to establish an HTTP/3 connection with a victim client. Attackers must either control an HTTP/3 server that the client connects to or perform active network interception to impersonate one. The attack is trivial to execute—sending empty UDP packets requires no special payload crafting—but depends on the client actually initiating an HTTP/3 connection to a malicious or compromised server. No user interaction is required; automated systems performing background downloads or API calls are equally vulnerable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) reflects the low attack complexity and lack of privileges or interaction needed.

Remediation

Update curl and libcurl to patched versions as released by the haxx curl project. Verify the specific patched version against the official curl security advisory. As a compensating control, restrict HTTP/3 connections to trusted servers, use network-level filtering to limit QUIC traffic to known endpoints, or temporarily disable HTTP/3 support by recompiling curl without QUIC if immediate patching is not feasible. Applications should implement connection timeouts and monitor for unexpected client stalls that may indicate exploitation attempts.

Patch guidance

Check the official curl security advisory and release notes for the patched version addressing CVE-2026-11352. Update all curl binaries and any statically linked libcurl libraries. For dynamic linking, ensure the system libcurl is updated and that any applications using it are restarted. Verify patched versions in development, staging, and production environments, including any container images and CI/CD agents that bundle curl. Test HTTP/3 functionality after patching to confirm the fix does not disrupt legitimate QUIC connections.

Detection guidance

Monitor for client applications hanging or becoming unresponsive during HTTP/3 connections, particularly if they target external or recently-changed servers. Network-level detection is challenging since the attack uses valid empty UDP datagrams; however, anomalous patterns of zero-length QUIC packets from a single server to multiple clients may indicate an attack. Review application logs and system metrics for curl or libcurl processes consuming high CPU or blocking indefinitely on network I/O. Implement alerting on client-side connection timeouts and stalls that correlate with HTTP/3 traffic. In environments with centralized logging, correlate client hangs with HTTP/3 connection attempts to the same endpoint.

Why prioritize this

This vulnerability scores 7.5 CVSS (HIGH severity) due to the ease of exploitation (no prerequisites, no user interaction) and availability impact on dependent applications. While not a data breach or code execution risk, the ability to remotely hang client applications makes this a medium-to-high priority for any organization using curl or libcurl in automation, downloads, or API integrations. Prioritization should account for the presence of HTTP/3 usage in your environment; purely HTTP/1.1 and HTTP/2 shops face lower risk. The lack of KEV activity as of the publication date suggests limited active exploitation, but the simplicity of the attack warrants swift patching.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a HIGH severity denial-of-service flaw with network accessibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and no user interaction (UI:N). The impact is limited to availability (A:H) with no confidentiality or integrity compromise. The score appropriately captures the severity of an easy-to-exploit remote DoS but is tempered by the requirement that the client must connect to the attacker's server. Organizations relying on outbound QUIC connections to untrusted endpoints or dynamic server lists should treat this as a priority-one remediation.

Frequently asked questions