Infinite loop in cURL - CVE-2026-11352

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU135072

Infinite loop in cURL - CVE-2026-11352

Published: June 24, 2026


Vulnerability identifier: #VU135072
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-11352
CWE-ID: CWE-835
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a loop with an unreachable exit condition in the QUIC UDP receive function when processing zero-length UDP datagrams from a connected HTTP/3 server. A remote attacker can continuously stream empty datagrams to cause a denial of service.

This issue only triggers on platforms featuring the recvmmsg() function call.


Affected software

cURL
LANTIME Operating System Firmware (LTOS)
Ubuntu
openEuler
Fedora
curl (Ubuntu package)
curl-debuginfo
curl-debugsource
libcurl
libcurl-devel
curl-help
curl

How to mitigate CVE-2026-11352

Install security update from vendor's website.

cURL - update to 8.21.0
LANTIME Operating System Firmware (LTOS) - update to 7.10.013
curl (Ubuntu package) - addressed in versions 7.35.0-1ubuntu2.20+esm21, 7.47.0-1ubuntu2.19+esm17, 7.58.0-2ubuntu3.24+esm10, 7.68.0-1ubuntu2.25+esm5, 8.5.0-2ubuntu10.11, 8.14.1-2ubuntu1.5, 8.18.0-1ubuntu2.3
curl-debuginfo - addressed in versions 7.71.1-52, 7.79.1-53, 8.4.0-35
curl-debugsource - addressed in versions 7.71.1-52, 7.79.1-53, 8.4.0-35
libcurl - addressed in versions 7.71.1-52, 7.79.1-53, 8.4.0-35
libcurl-devel - addressed in versions 7.71.1-52, 7.79.1-53, 8.4.0-35
curl-help - addressed in versions 7.71.1-52, 7.79.1-53, 8.4.0-35
curl - addressed in versions 7.71.1-52, 7.79.1-53, 8.4.0-35
curl - update to 8.18.0-9.fc44

External References

Related Security Bulletins