CVE-2026-11352

Name of the Vulnerable Software and Affected Versions cURL (affected versions not specified) libcurl (affected versions not specified)

Description An issue in the QUIC UDP receive function allows a remote malicious HTTP/3 server to cause a denial of service. The helper function fails to count zero-length UDP datagrams toward the per-call packet budget before discarding them, enabling a connected QUIC peer to stream empty datagrams and indefinitely stall the client.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.