Skip to main content

curl CVE-2026-11352

| EUVDEUVD-2026-41498 HIGH
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-06-24 GHSA-qxwx-hr5v-h5q4
Denial Of Service Curl Haxx
7.5
CVSS 3.1 · Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure curl HTTP/3 client to malicious server
  2. Delivery
    Establish QUIC connection over UDP
  3. Exploit
    Stream continuous zero-length datagrams
  4. Execution
    Empty packets skip per-call budget count
  5. Persist
    Receive loop livelocks indefinitely
  6. Impact
    Client hangs (denial of service)

Vulnerability Assessment

Weakness
CWE
CWE-835
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the curl/libcurl client is built with HTTP/3 support and actually uses the HTTP/3 (QUIC over UDP) protocol for the connection - the bug is in the QUIC UDP receive function and does not affect HTTP/1.1 or HTTP/2 traffic. The client must establish and keep a QUIC connection to an attacker-controlled or compromised HTTP/3 server, which then continuously streams zero-length UDP datagrams. Limiting factors that reduce real-world exposure: HTTP/3 is not compiled into every curl/libcurl build and is not the default protocol, so non-HTTP/3 clients are unaffected; and the attacker must occupy the server side of the victim's connection (the victim must be induced to reach out to a malicious QUIC endpoint) rather than attacking an arbitrary listening service. Affected versions are curl 8.18.0, 8.19.0, and 8.20.0.
Impact

The available signals are consistent and point to a real-but-moderate priority rather than an emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) yields 7.5 driven entirely by availability, with no confidentiality or integrity impact. EPSS is low at 0.28% (20th percentile), the vulnerability is not on CISA KEV, and no public POC is identified in the provided data (a HackerOne report, 3783438, is referenced as the likely private origin) - so there is no evidence of active exploitation. The most important nuance the raw CVSS understates: this is a CLIENT-side vulnerability that only triggers when the curl client itself initiates an HTTP/3 (QUIC) connection to an attacker-controlled or compromised server, and only in builds where HTTP/3 is compiled in and actually used - a meaningful real-world limiter not captured by AV:N/PR:N/UI:N. CVSS marks network vector with no user interaction, but exploitation practically requires the victim to be induced to connect to a malicious HTTP/3 endpoint; treat AV:N as accurate for the transport while recognizing this connection-initiation precondition. Net: patch on normal cadence, prioritize higher only where curl/libcurl HTTP/3 clients talk to untrusted servers.
Exploit ScenarioDerived

An attacker stands up (or compromises) an HTTP/3 server and lures a curl/libcurl HTTP/3 client to connect - for example an automated fetcher, updater, or backend service that retrieves URLs over QUIC. Once the QUIC session is established, the malicious server streams a continuous flood of zero-length UDP datagrams, which are discarded before counting toward the client's per-call receive budget, causing the client's receive loop to livelock and hang indefinitely. No public exploit code is identified at time of analysis, and the low complexity (AC:L) means the empty-datagram trick is trivial to reproduce once a connection exists.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv7 – Jul 06, 2026

Remote denial of service in curl and libcurl (versions 8.18.0 through 8.20.0) lets a malicious or compromised HTTP/3 server indefinitely stall a connecting client. The flaw lives in curl's QUIC UDP receive path, where zero-length UDP datagrams are discarded before they are counted against the per-call packet budget, so a peer that streams a continuous flood of empty datagrams keeps the receive loop spinning without ever making progress. There is no public exploit identified at time of analysis, EPSS risk is low (0.28%, 20th percentile), and impact is availability-only (no data compromise).

Earlier versions of this analysis (6)
v6 Jul 06, 2026 - 21:50 cvss changed CVSS 7.5

Denial of service in curl/libcurl (versions 8.18.0 through 8.20.0) when using HTTP/3 lets a malicious or attacker-controlled QUIC server indefinitely stall the client by streaming a continuous flood of zero-length UDP datagrams. Because curl's QUIC receive helper discards empty datagrams before they count against the per-call packet-processing budget, the receive loop never terminates, hanging the transfer. Rated CVSS 7.5 (availability-only); no public exploit code is identified at time of analysis, though a HackerOne report (3783438) documents the flaw, and EPSS is low at 0.28% (20th percentile).

v5 Jul 06, 2026 - 21:49 cvss changed CVSS 7.5

Remote denial of service in curl and libcurl 8.18.0 through 8.20.0 lets a malicious or compromised HTTP/3 server indefinitely stall a client over QUIC. Because curl's QUIC UDP receive helper discards zero-length UDP datagrams before they count against the per-call packet budget, a connected peer can flood empty datagrams so the receive loop never satisfies its exit condition and the transfer hangs. CVSS is 7.5 (availability-only); EPSS is low at 0.28% (20th percentile), no public exploit is identified at time of analysis, and it is not listed in CISA KEV.

v4 Jul 06, 2026 - 21:49 cvss changed CVSS 7.5

Remote denial of service in curl/libcurl 8.18.0 through 8.20.0 lets a malicious or attacker-controlled HTTP/3 server stall any client that connects to it over QUIC. The QUIC UDP receive helper discards zero-length UDP datagrams before they count against the per-call packet budget, so a connected peer can stream an endless flood of empty datagrams that never advances the loop, indefinitely hanging the transfer. EPSS is low (0.28%, 20th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis, though a HackerOne report (3783438) documents the flaw.

v3 Jul 06, 2026 - 21:48 cvss changed CVSS 7.5

Remote denial of service in curl and libcurl (versions 8.18.0 through 8.20.0) lets a malicious or compromised HTTP/3 server indefinitely stall a connecting client. The QUIC UDP receive helper discards zero-length UDP datagrams before they count toward the per-call packet budget, so a connected QUIC peer can stream an unbounded flood of empty datagrams that the client keeps processing without ever completing the receive loop. No public exploit identified at time of analysis; EPSS is low (0.28%, 20th percentile) and the issue is not on CISA KEV, so this is an availability-only bug rather than a code-execution threat.

v2 Jul 06, 2026 - 21:45 cvss changed CVSS 7.5

Remote denial of service in curl/libcurl 8.18.0 through 8.20.0 allows a malicious or compromised HTTP/3 server to indefinitely stall a connecting client by streaming a continuous flood of zero-length QUIC UDP datagrams. Because curl's QUIC receive helper discards empty datagrams before they count against the per-call packet-processing budget, the receive loop never terminates and the client hangs. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.28%, 20th percentile); impact is availability-only with no data exposure.

v1 Jun 24, 2026 - 18:29

CPU exhaustion via busy-loop in curl's QUIC implementation allows a network-adjacent or remote attacker to cause a denial of service by sending zero-length UDP datagrams to a curl client making an HTTP/3 request. Affects curl versions up to and including 8.20.0; fixed in 8.21.0 released June 24, 2026. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV. The curl project rates this LOW severity, consistent with the constrained exploitation prerequisites (HTTP/3 must be compiled in and actively in use).

RemediationAI

No vendor-released patch version is identified in the provided data; the curl advisory at https://curl.se/docs/CVE-2026-11352.html is the authoritative source for the exact fixed release (curl's practice is to fix in the next tagged release above the affected line, but the specific version is not confirmed from the input and should not be assumed). Upgrade curl/libcurl to that fixed release once confirmed from the advisory. As an interim compensating control, disable or avoid HTTP/3 for affected clients - for the curl CLI, do not pass --http3 / --http3-only and let it fall back to HTTP/2 or HTTP/1.1 (trade-off: loss of QUIC latency/performance benefits); for libcurl applications, avoid setting CURLOPT_HTTP_VERSION to CURL_HTTP_VERSION_3, or build libcurl without an HTTP/3 backend. Additionally restrict HTTP/3 clients to trusted servers and monitor/limit connection duration, since the attack requires the client to remain connected to a hostile QUIC peer. Review the oss-security thread (https://seclists.org/oss-sec/2026/q2/1012) for coordinated fix details.

Affected VersionsENISA

curl 8.20.0 ≤8.20.0
curl 8.18.0 ≤8.18.0
curl 8.19.0 ≤8.19.0

Affected Packages

euvd curl no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

curl/libcurl is one of the most widely embedded HTTP client libraries in existence, and this issue is specific to its HTTP/3 support, which runs over the QUIC transport on top of UDP rather than TCP. QUIC receive handling reads datagrams in batches bounded by a per-call packet budget to keep a single call from monopolizing the event loop. The helper function that feeds this loop discards zero-length UDP datagrams before incrementing the budget counter, so empty datagrams never count toward the limit. A connected QUIC peer can therefore stream an unbounded sequence of empty datagrams and the loop never reaches its exit condition, producing a livelock/hang. No CWE was assigned in the input, but the root cause is an improper loop-termination / uncontrolled-resource-consumption condition (CWE-835 uncontrolled loop / CWE-400 class). The EUVD record (EUVD-2026-41498) enumerates the affected curl builds.

Know when Curl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 6.5 HIGH

Network QUIC transport with trivial empty-datagram trigger (AV:N/AC:L), no server-side auth (PR:N); availability-only livelock (A:H), no confidentiality/integrity impact, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 06, 2026 - 21:51 vuln.today
v7 - CVSS changed
Analysis Updated
Jul 06, 2026 - 21:50 vuln.today
v6 - CVSS changed
Analysis Updated
Jul 06, 2026 - 21:49 vuln.today
v5 - CVSS changed
Analysis Updated
Jul 06, 2026 - 21:49 vuln.today
v4 - CVSS changed
Analysis Updated
Jul 06, 2026 - 21:48 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 06, 2026 - 21:45 vuln.today
v2 - CVSS changed
CVSS changed
Jul 06, 2026 - 19:22 NVD
7.5 (HIGH)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Executive ViewAI

Why It Matters

curl and libcurl versions 8.18.0 through 8.20.0 can be remotely disabled by malicious HTTP/3 servers, causing application services to hang indefinitely with no vendor patch currently available. Organizations relying on these library versions for production services face potential availability impact and should prioritize remediation.

Business Impact: Medium
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Downgrade to curl/libcurl 8.17.x or lower; (2) Disable HTTP/3 globally and enforce HTTP/2-only mode; (3) Network firewall rules to restrict HTTP/3 traffic to explicitly whitelisted servers only; (4) Configure aggressive connection timeouts to detect and terminate stalled connections; (5) Implement real-time monitoring and alerting for hung or unresponsive curl/libcurl processes; (6) Isolate HTTP/3 usage to non-production test environments until patched.

Threat Intelligence Overview

EPSS Score
0.3%
Top 80% exploitable
Prevalence
Ubiquitous
curl/libcurl embedded in vast numbers of systems; only HTTP/3 builds affected
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Medium

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Curl

View all
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32206 MEDIUM POC
6.5 Jul 07

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2022-43551 HIGH POC
7.5 Dec 23

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2022-32205 MEDIUM POC
4.3 Jul 07

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto
CVE-2025-9086 HIGH POC
7.5 Sep 12

1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack co
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP6-CHOST-BYOS Not-Affected
SLES15-SP6-CHOST-BYOS-Aliyun Not-Affected
SLES15-SP6-CHOST-BYOS-Azure Not-Affected
SLES15-SP6-CHOST-BYOS-EC2 Not-Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:34975 ADVISORY https://curl.se/docs/CVE-2026-11564.html ADVISORY https://curl.se/docs/CVE-2026-12064.html ADVISORY https://curl.se/docs/CVE-2026-9080.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-11352 ADVISORY https://seclists.org/oss-sec/2026/q2/1012 ADVISORY https://ubuntu.com/security/notices/USN-8525-1 ADVISORY https://vuldb.com/vuln/376062 REF https://curl.se/docs/CVE-2026-11352.html REF https://curl.se/docs/CVE-2026-11352.json REF https://hackerone.com/reports/3783438

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy