CVE-2026-11352: Haxx Curl QUIC DoS Vulnerability

CVE-2026-11352 Overview

CVE-2026-11352 is a denial of service vulnerability in curl's QUIC UDP receive function. A malicious HTTP/3 server can stall a curl or libcurl client indefinitely by streaming empty UDP datagrams. The helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget. This creates an unbounded processing loop [CWE-835] that the attacker controls.

The flaw affects HTTP/3 clients connecting to attacker-controlled or compromised servers. Automation, CI/CD pipelines, and applications embedding libcurl for HTTP/3 traffic are exposed. The issue has an EPSS score of 1.01% as of 2026-07-09.

Critical Impact
A connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client, causing a remote denial of service against any curl or libcurl process using HTTP/3.

Affected Products

Haxx curl (command-line tool with HTTP/3 support)
Haxx libcurl (library builds compiled with QUIC/HTTP/3 support)
Applications and services that embed vulnerable libcurl versions

Discovery Timeline

2026-07-03 - CVE CVE-2026-11352 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-11352

Vulnerability Analysis

The vulnerability lives in the helper function that curl uses to drain UDP datagrams from a QUIC socket during HTTP/3 sessions. The function processes incoming datagrams in a loop bounded by a per-call packet budget. Zero-length datagrams are treated as non-events and skipped without decrementing the budget counter.

A malicious HTTP/3 server that has completed the QUIC handshake with the client can then send a continuous stream of empty datagrams. Because empty datagrams never count against the budget, the receive loop never yields control back to the caller. The curl client thread becomes stuck inside the receive function and cannot make progress on the transfer, timeouts, or signal handling.

The issue is classified as an infinite loop condition [CWE-835]. It requires no authentication, no user interaction, and can be triggered over the network against any client that initiates an HTTP/3 request to the attacker's endpoint.

Root Cause

The root cause is the ordering of two operations in the QUIC UDP receive helper. The code discards zero-length UDP datagrams before it decrements the per-call packet budget counter. This lets a peer produce an unbounded number of "free" iterations that never advance the loop toward its exit condition.

Attack Vector

The attacker hosts or controls an HTTP/3 server and induces a victim to connect. Once the QUIC connection is established, the server streams zero-length UDP datagrams to the client. The victim's curl or libcurl process stalls until the underlying TCP/QUIC session is externally terminated. See the cURL CVE-2026-11352 Advisory and the HackerOne Report #3783438 for reproduction details.

No verified public exploit code is available. The vulnerability mechanism is described in prose above; refer to the vendor advisory for the exact function name and patch diff.

Detection Methods for CVE-2026-11352

Indicators of Compromise

Long-running curl or libcurl-based processes that stop making network progress while still holding an established QUIC/UDP session.
High volumes of inbound zero-length UDP datagrams on ports negotiated for HTTP/3 (typically UDP/443).
HTTP/3 client transfers that never complete and never time out cleanly, with CPU pinned in the receive path.

Detection Strategies

Inventory hosts running curl or applications linked against libcurl with HTTP/3/QUIC support enabled and compare versions against the fixed release in the vendor advisory.
Alert on outbound HTTP/3 connections from servers, containers, and CI runners to untrusted destinations, since QUIC often bypasses legacy proxy inspection.
Use process telemetry to flag curl processes exceeding expected runtime or held on a single UDP socket beyond normal transfer windows.

Monitoring Recommendations

Enable UDP flow logging for egress on UDP/443 and correlate long-lived flows with the initiating process.
Monitor for anomalous packet-size distributions on QUIC flows, specifically a high ratio of zero-payload datagrams.
Track library versions of libcurl across container images and build artifacts so vulnerable builds can be identified after disclosure.

How to Mitigate CVE-2026-11352

Immediate Actions Required

Upgrade curl and libcurl to the fixed version listed in the cURL CVE-2026-11352 Advisory.
Rebuild and redeploy any application, container image, or appliance that statically links or bundles a vulnerable libcurl.
Restrict outbound HTTP/3 traffic from servers and automation hosts to known, trusted endpoints until patching is complete.

Patch Information

Haxx has published a fix and advisory at curl.se/docs/CVE-2026-11352.html with structured metadata at curl.se/docs/CVE-2026-11352.json. Update to the patched release and verify the libcurl version reported by curl --version on all affected systems.

Workarounds

Disable HTTP/3 in applications by removing the --http3 flag or the equivalent CURLOPT_HTTP_VERSION setting that requests HTTP/3.
Build libcurl without QUIC/HTTP/3 support if the feature is not required by the workload.
Enforce short application-level timeouts on transfers and terminate curl processes that exceed expected duration.

bash

# Configuration example
# Verify installed curl version
curl --version

# Force HTTP/2 or HTTP/1.1 as a temporary workaround
curl --http2 https://example.com/
curl --http1.1 https://example.com/

# In libcurl, avoid requesting HTTP/3
# curl_easy_setopt(handle, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2TLS);