SB2026110446 - SUSE update for curl
Published: November 4, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 31 vulnerabilities.
1) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-86414)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose origin credentials.
The vulnerability exists due to incorrect handling of origin authentication challenges in libcurl's HTTP proxy tunnel handling when processing responses to CONNECT requests. A remote attacker can return an HTTP 401 response with a WWW-Authenticate header instead of the expected HTTP 407 response with a Proxy-Authenticate header to disclose origin credentials.
Exploitation requires the client to use an attacker-controlled HTTP proxy. Exposed credentials can include a Basic authentication password or a Negotiate/Kerberos ticket.
2) Information disclosure (CVE-ID: CVE-2026-9546)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to exposure of sensitive information in the libcurl HTTP Referer header handling when processing subsequent HTTP requests after CURLOPT_REFERER is cleared with NULL. A remote attacker can receive a subsequent request that erroneously includes a previously configured Referer header to disclose sensitive information.
This issue affects libcurl and does not affect the curl command line tool.
3) Insufficiently protected credentials (CVE-ID: CVE-2026-94266)
CWE-ID: CWE-522 - Insufficiently Protected Credentials
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to obtain sensitive credentials.
The vulnerability exists due to insufficient protection of credentials in the curl_easy_getinfo CURLINFO_EFFECTIVE_URL option when retrieving credentials from a .netrc file. A local user can read credentials exposed in the returned effective URL to obtain sensitive credentials.
Credentials can appear even when neither the original URL nor the redirected URL contains them. The curl command-line option --write-out '%{url_effective}' exposes the same information.
4) Information disclosure (CVE-ID: CVE-2026-94265)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose Kerberos tickets to an untrusted third-party host.
The vulnerability exists due to improper retention of authentication state in curl's HTTP Negotiate authentication handling when processing an HTTP redirect to a URL containing userinfo. A remote attacker can send a redirect containing arbitrary username and password information from a malicious server to disclose Kerberos tickets to an untrusted third-party host.
The ticket is generated using the ambient identity of the client process. Exploitation does not require the --location-trusted option to be enabled.
5) Use-after-free (CVE-ID: CVE-2026-92392)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to use-after-free in curl's HTTP/2 upload handling when processing server-supplied stream resets during an upload. A remote attacker can send specially crafted HTTP/2 RST_STREAM frames with the HTTP_1_1_REQUIRED or REFUSED_STREAM reason to execute arbitrary code.
The demonstrated exploitation requires knowledge of the exact curl object layout, target architecture, compatible libc allocator and heap layout, and calibrated leak and symbol offsets. It also depends on nghttp2 and OpenSSL/TLS 1.3 allocation behavior, a pinned CA bundle and input-dependent allocation geometry, and the timing of two parallel transfers. The demonstrated exploit has an approximately 23-byte command constraint.
6) Uncontrolled Recursion (CVE-ID: CVE-2026-92391)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in libcurl's curl_mime_free function when traversing deeply nested multipart MIME structures during cleanup. A local user can construct a deeply nested multipart MIME structure through the public API to cause a denial of service.
Triggering the flaw requires thousands of nested MIME parts, with the exact threshold depending on the system and configuration. The curl command line tool is not affected.
7) External Control of File Name or Path (CVE-ID: CVE-2026-92390)
CWE-ID: CWE-73 - External Control of File Name or Path
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to overwrite existing local files.
The vulnerability exists due to failure to preserve anti-clobbering protection in the curl command line tool's HTTP response handling when processing responses with --remote-header-name (-J) enabled. A remote attacker can serve a response containing a Content-Disposition filename preceded by an intermediate 103 Early Hints response, or by an ETag header when --etag-save is enabled, to overwrite existing local files.
The flaw affects only the command line tool, not libcurl.
8) Information disclosure (CVE-ID: CVE-2026-92389)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper validation of state transitions against the requested transfer direction in libcurl's TFTP state machine when handling opening server responses to download requests. A remote attacker can send a specially crafted server response that forces the client into transmit mode to disclose sensitive information.
Data is consumed from the handle's persistent CURLOPT_READDATA pointer, which may retain data from unrelated prior operations, such as an HTTP POST request executed on a reused handle. The curl command-line tool is not affected.
9) Use-after-free (CVE-ID: CVE-2026-92388)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and corrupt memory.
The vulnerability exists due to use-after-free and type confusion in libcurl's FTP wildcard write callback handling when reusing or cloning an easy handle after a failed FTP wildcard LIST operation. A remote attacker can supply server response bytes that are processed through the incorrectly retained internal listing parser to cause a denial of service and corrupt memory.
Exploitation requires CURLOPT_FTP_WILDCARD to be enabled. The use-after-free read occurs when the original handle is freed before a transfer executes on its duplicate. Type confusion occurs when the application changes CURLOPT_WRITEDATA without also changing CURLOPT_WRITEFUNCTION. The curl command-line tool is not affected.
10) Infinite loop (CVE-ID: CVE-2026-92387)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a loop with an unreachable exit condition in libcurl's FTP, IMAP, POP3, and SMTP control-response handling when processing server responses. A remote attacker can permanently omit the final control-response line to cause a denial of service by bypassing configured transfer timeouts and indefinitely blocking all concurrent transfers bound to the same multi-handle.
Sustaining the loop requires the server to feed data at the client's read speed, requiring a very high network speed or an unusually slow client. The curl command-line tool is not affected.
11) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-92386)
CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to prematurely terminate cookie jar parsing, causing subsequent valid cookies to be ignored.
The vulnerability exists due to improper validation of cookie record length in the Netscape cookie jar writer and parser when writing server-supplied cookies and subsequently loading the cookie jar. A remote attacker can supply a long cookie name and value through an HTTP server response to prematurely terminate cookie jar parsing, causing subsequent valid cookies to be ignored.
Exploitation requires a subsequent invocation to read the same cookie jar using --cookie. The server cannot determine or control the cookie's relative position in the jar, so the oversized record may affect many, few, or no other cookies.
12) Authentication Bypass by Primary Weakness (CVE-ID: CVE-2026-8932)
CWE-ID: CWE-305 - Authentication Bypass by Primary Weakness
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass client certificate authentication.
The vulnerability exists due to authentication bypass by primary weakness in libcurl connection reuse logic when reusing a previously established connection after changing mTLS client certificate settings. A remote user can reuse a connection with mismatched client certificate configuration to bypass client certificate authentication.
The issue affects libcurl and does not affect the curl command line tool.
13) Command injection (CVE-ID: CVE-2026-87864)
CWE-ID: CWE-77 - Command injection
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject and execute IMAP commands within an authenticated session.
The vulnerability exists due to improper handling of a length parameter inconsistency in curl's IMAP APPEND implementation when processing uploads. A remote user can supply upload data whose line-ending conversion expands it beyond the advertised literal length to inject and execute IMAP commands within an authenticated session.
Exploitation requires CURLOPT_CRLF to be enabled.
14) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-87863)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to erase persisted HSTS cache entries.
The vulnerability exists due to improper handling of time serialization failures in HSTS cache persistence when saving entries received from an authenticated HTTPS origin. A remote user can supply an HSTS max-age value that the parser accepts but time serialization cannot process to erase persisted HSTS cache entries.
On 64-bit systems, extreme max-age values can produce expiry times within time integer limits but beyond calendar time structure bounds. Cache save errors are silently ignored during cleanup, allowing curl to exit successfully.
15) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-87862)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to obtain information sent over unencrypted HTTP.
The vulnerability exists due to incorrect discarding of longer-lived child HSTS entries in curl's HSTS cache import functionality when importing an includeSubDomains parent entry before a longer-lived child entry. A remote attacker can take advantage of the loss of HTTPS enforcement after the parent entry expires to obtain information sent over unencrypted HTTP.
16) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-87861)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper isolation of authenticated connections between origins in curl's HTTP connection reuse logic when sending HTTP requests using ambient user credentials. A remote attacker can exploit reuse of a connection previously authenticated via Negotiate for a different origin to disclose sensitive information.
Ambient credentials are used when a blank user name is provided and the actual identity and credentials are managed outside curl.
17) Exposure of Data Element to Wrong Session (CVE-ID: CVE-2026-107929)
CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause transfers to use an unintended source address.
The vulnerability exists due to omission of source bindings from the connection reuse key in curl's connection reuse logic when processing transfers configured through CURLOPT_INTERFACE or --interface with the if!, host!, or ifhost! prefixes. A local user can initiate a later transfer requesting a different source that silently reuses an existing connection to cause transfers to use an unintended source address.
18) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-86413)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose Negotiate authentication credentials to an unrelated origin.
The vulnerability exists due to improper restriction of credential forwarding in curl's Negotiate authentication handling when following redirects. A remote attacker can cause a redirect to an unrelated origin using a URL containing a username and password to disclose Negotiate authentication credentials to an unrelated origin.
Exploitation requires an ambient user, configured by supplying a blank username so that curl uses credentials provided by the Kerberos system. The issue only triggers when usernames in URLs are permitted.
19) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-86412)
CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to delete cookies for unrelated domains and cause a denial of service.
The vulnerability exists due to improper handling of exceptional cookie size conditions in curl's cookie jar loading and cleanup procedures when reloading a stored cookie that exceeds the cookie file line limit. A remote attacker can serve a specially crafted HTTP cookie that curl accepts and stores but subsequently refuses to reload to delete cookies for unrelated domains and cause a denial of service.
Exploitation requires a subsequent curl invocation using the same file path for --cookie and --cookie-jar. That invocation fails before connecting, and cleanup replaces the cookie jar with an empty file.
20) Exposure of Data Element to Wrong Session (CVE-ID: CVE-2026-86411)
CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform FTP transfers under another handle's client-certificate identity.
The vulnerability exists due to exposure of authentication state to the wrong session in libcurl's FTP connection reuse logic when reusing a pooled control connection previously upgraded with STARTTLS and authenticated using a client certificate. A local user can initiate an ftp:// transfer configured with CURLUSESSL_NONE using that connection pool to perform FTP transfers under another handle's client-certificate identity.
The second handle performs neither a new TLS handshake nor a new FTP login.
21) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-86410)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass SSH host verification.
The vulnerability exists due to improper initialization of SSH host verification options in the curl command-line tool when following redirects from HTTPS to SFTP or SCP. A remote attacker can return a redirect to an SFTP or SCP destination to bypass SSH host verification.
Exploitation requires redirect following and redirects to SFTP or SCP to be enabled. The requested verification methods specified through --knownhosts, --hostpubsha256, or --hostpubmd5 are not applied to the redirected connection. libcurl is not affected.
22) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-86409)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose an access-key identifier and a request-bound signature.
The vulnerability exists due to failure to disable SigV4 authentication in libcurl's SigV4 authentication handling when an application sets CURLOPT_AWS_SIGV4 to NULL and reuses the same easy handle while retaining CURLOPT_USERPWD credentials. A remote attacker can influence the destination URL of a subsequent request to disclose an access-key identifier and a request-bound signature.
The secret key is not transmitted. This flaw is not accessible through the curl command line tool.
23) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-82209)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to information exposure through sent data in the libcurl cookie handling logic when processing a Set-Cookie header with a Domain attribute matching an origin host that is itself a public suffix. A remote attacker can induce the client to send a previously stored cookie to an arbitrary sibling subdomain under the same public suffix to disclose sensitive information.
Exploitation requires libpsl support to be enabled, the apex public-suffix host to issue the cookie, and the client to subsequently contact an attacker-controlled sibling subdomain.
24) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-80255)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper cookie attribute handling in the Set-Cookie header processing logic when parsing a Set-Cookie header that uses a tab immediately before the Secure attribute. A remote attacker can send a specially crafted Set-Cookie header to disclose sensitive information.
The issue can cause a cookie to be stored without its Secure flag and then be sent over plaintext HTTP on subsequent requests to the same host.
25) Exposure of Data Element to Wrong Session (CVE-ID: CVE-2026-19931)
CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause requests to be sent over another user's previously authenticated connection.
The vulnerability exists due to exposure of data element to wrong session in HTTP connection reuse for Negotiate authentication when reusing a connection established with empty credentials. A remote user can issue a request using blank credentials to cause requests to be sent over another user's previously authenticated connection.
This issue affects libcurl and the curl command line tool when Negotiate authentication is used with ambient credentials provided by SSPI or GSSAPI.
26) Use-after-free (CVE-ID: CVE-2026-18924)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger a use-after-free.
The vulnerability exists due to use-after-free in libcurl HTTP/2 server push stream handling when processing an HTTPS HTTP/2 server push on a shared connection. A remote attacker can send a server push response sequence to trigger a use-after-free.
The issue affects libcurl only and requires HTTP/2 server push to be enabled and accepted by the application, along with connection sharing.
27) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-12064)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to connect to an unverified SSH remote host.
The vulnerability exists due to improper validation of certificate with host mismatch in the curl command line tool when processing a schemeless URL combined with --proto-default for sftp or scp. A remote attacker can present an SSH server in that connection flow to connect to an unverified SSH remote host.
This issue affects only the curl command line tool and does not affect other users of libcurl or the libcurl library itself.
28) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-11856)
CWE-ID: CWE-294 - Authentication Bypass by Capture-replay
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication by replaying Digest authentication state.
The vulnerability exists due to authentication bypass by capture-replay in libcurl Digest authentication handling when reusing the same handle for a second transfer to a different HTTP origin. A remote attacker can receive a request containing an Authorization header intended for another origin to bypass authentication by replaying Digest authentication state.
The issue affects libcurl but not the curl command line tool. The leaked header does not reveal the other origin, and the exposed state allows replay only for the exact path of the captured request.
29) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-11586)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the WebSocket auto-PONG handling when processing rapid sequential WebSocket PING frames from a server. A remote attacker can send rapid sequential PING frames to cause a denial of service.
This issue affects both libcurl and the curl command line tool.
30) Improper Certificate Validation (CVE-ID: CVE-2026-11564)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass certificate trust restrictions.
The vulnerability exists due to improper certificate validation in libcurl connection reuse logic when reusing an easy handle after switching from native CA trust to custom CA material. A remote attacker can present a TLS certificate trusted by the native platform store to bypass certificate trust restrictions.
This issue applies to builds that use Native CA by default on Apple operating systems or Windows, and affects the OpenSSL, GnuTLS, Schannel, and Rustls TLS backends.
31) Infinite loop (CVE-ID: CVE-2026-11352)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a loop with an unreachable exit condition in the QUIC UDP receive function when processing zero-length UDP datagrams from a connected HTTP/3 server. A remote attacker can continuously stream empty datagrams to cause a denial of service.
This issue only triggers on platforms featuring the recvmmsg() function call.
Remediation
Install update from vendor's website.