Is CVE-2026-11352 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11352 being exploited in the wild.

How severe is CVE-2026-11352?

Informational severity, with a CVSS score of 0, published 3 July 2026.

Which products and versions are affected?

curl curl 8.18.0 to 8.20.0; curl libcurl 8.18.0 to 8.20.0.

Is there a fix for CVE-2026-11352?

A patch was published on 2026-06-24: Fixed in version 8.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11352 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-11352?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11352: curl QUIC infinite loop in UDP receive function

CVE-2026-11352 · Severity: info · CVSS 0 · Published 2026-07-03

A vulnerability in the curl data transfer tool and library can allow a malicious website to freeze the application. By sending a continuous stream of empty data packets over an HTTP/3 connection, a server can force the curl client into an infinite loop. This results in a denial of service where the application becomes unresponsive and stops processing other tasks.

Quick answers

Is CVE-2026-11352 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11352 being exploited in the wild.
How severe is CVE-2026-11352?: Informational severity, with a CVSS score of 0, published 3 July 2026.
Which products and versions are affected?: curl curl 8.18.0 to 8.20.0; curl libcurl 8.18.0 to 8.20.0.
Is there a fix for CVE-2026-11352?: A patch was published on 2026-06-24: Fixed in version 8.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11352 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-11352?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial of service vulnerability exists in curl's QUIC implementation (CWE-835). The root cause is located in the UDP receive helper function, which discards zero-length UDP datagrams without counting them toward the per-call packet processing budget. A malicious HTTP/3 server can exploit this by continuously streaming empty datagrams, causing the client to enter a busy-loop and indefinitely stall. This issue specifically affects platforms utilizing the recvmmsg() system call. The vulnerability was introduced in version 8.18.0 and is resolved in version 8.21.0.

Affected products

curl curl 8.18.0 to 8.20.0
curl libcurl 8.18.0 to 8.20.0

Timeline

2026-06-05: disclosed: Reported via HackerOne
2026-06-24: patched: Fixed in version 8.21.0
2026-06-24: advisory: Project advisory published
2026-07-03: other: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.