CVE-2026-11352: 
cURL vulnerability analysis and mitigation

CVE-2026-11352 is a denial-of-service vulnerability in curl's QUIC UDP receive function, named "QUIC zero-length UDP datagrams busy-loop." A malicious HTTP/3 server can exploit a logic flaw where zero-length UDP datagrams are discarded before being counted toward the per-call packet budget, allowing a connected QUIC peer to continuously stream empty datagrams and indefinitely stall the client. It affects curl and libcurl versions 8.18.0 through 8.20.0 (inclusive); versions prior to 8.18.0 and 8.21.0 or later are not affected. The vulnerability was reported on June 5, 2026, and publicly disclosed on June 24, 2026, coordinated with the release of curl 8.21.0. It carries a CVSS v3.1 base score of 7.5 (High) (curl Advisory, GitHub Advisory).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). The vulnerability exists in curl's QUIC UDP receive helper function, which uses recvmmsg() to batch-receive UDP datagrams; zero-length datagrams are silently discarded before being counted toward the per-call packet budget, meaning a malicious peer can flood the client with empty datagrams without ever exhausting the budget, causing the receive loop to spin indefinitely. Exploitation requires the client to connect to a malicious HTTP/3 server over QUIC, and the vulnerability only triggers on platforms that feature the recvmmsg() system call. A proof-of-concept exploit consisting of a self-contained bash script with embedded C helper code and a Python HTTP/3 server is publicly available (HackerOne Report, curl Advisory). The vulnerability was introduced in commit 6a3d0b6d631d5e9bec797306b5b41a9f440a088d and fixed in commit 56eca2afb4806f1032872fa97d1834b3c1385276 (curl JSON).

Successful exploitation causes the curl or libcurl client to enter an infinite busy-loop, rendering it completely unresponsive — a full denial of service with high availability impact. There is no confidentiality or integrity impact; the attack is limited to stalling the affected client process. Applications and services that rely on curl or libcurl for HTTP/3 transfers on recvmmsg()-capable platforms (primarily Linux) are at risk of hanging indefinitely when connecting to a malicious or compromised server (curl Advisory, GitHub Advisory).

1. Set up a malicious HTTP/3 server: Deploy a rogue server capable of speaking QUIC/HTTP3, using the Python component from the public PoC (available at the HackerOne report) that is configured to respond with a continuous stream of zero-length UDP datagrams.
2. Compile the C helper: Build the embedded C helper (sendmmsg_zero_flood_helper.c) from the PoC, which uses sendmmsg() to efficiently send large batches of zero-length UDP datagrams to the target.
3. Lure or position the victim client: Cause a curl or libcurl client (version 8.18.0–8.20.0 on a Linux system with recvmmsg()) to initiate an HTTP/3 request to the attacker-controlled server — for example, via a redirect, SSRF, or by controlling DNS resolution.
4. Flood with zero-length datagrams: Once the QUIC connection is established, the malicious server begins streaming empty UDP datagrams. Because these are discarded before counting toward the packet budget, the client's receive loop never exits.
5. Achieve denial of service: The curl/libcurl client process enters an infinite busy-loop and becomes permanently unresponsive, requiring external termination (HackerOne Report, curl Advisory).

• Process: curl or libcurl process consuming 100% CPU on a single core with no progress on HTTP/3 transfers; process appears hung and unresponsive to signals.
• Network: High-volume UDP traffic from a remote server to the curl client on the QUIC port (typically UDP/443), consisting of unusually small or zero-payload datagrams; use of recvmmsg() syscalls in high frequency observable via strace.
• Logs: Application logs showing an HTTP/3 request initiated but never completing; absence of response or timeout logs despite ongoing network activity.
• System: Elevated recvmmsg syscall counts for the curl process visible via perf or strace; process state stuck in user-space loop rather than blocking on I/O (curl Advisory, HackerOne Report).

The primary remediation is to upgrade curl and libcurl to version 8.21.0 or later, which was released on June 24, 2026 (curl Advisory). Alternatively, the fix commit (56eca2afb4806f1032872fa97d1834b3c1385276) can be applied and curl rebuilt from source. As a workaround where patching is not immediately possible, avoid using HTTP/3 (e.g., pass --http1.1 or --http2 flags to curl, or set CURLOPT_HTTP_VERSION to exclude HTTP/3 in libcurl applications), or restrict connections to trusted HTTP/3 servers only (curl Advisory, GitHub Advisory). Red Hat and Ubuntu have issued tracking advisories for downstream packages (Red Hat Bugzilla, Ubuntu USN-8525-1).

The curl 8.21.0 release, which patched 18 security vulnerabilities including CVE-2026-11352, received notable media coverage. Several outlets highlighted a separate "25-year-old" libcurl vulnerability patched in the same release, drawing broader attention to the curl 8.21.0 security update (CyberPress, CyberSecurityNews). curl project lead Daniel Haxx announced the release on his blog (Daniel Haxx Blog). Red Hat and Ubuntu promptly opened tracking bugs and security notices for their downstream packages, indicating active vendor response (Red Hat Bugzilla).