Executive brief
A vulnerability in the curl data transfer tool and library can allow a malicious website to freeze the application. By sending a continuous stream of empty data packets over an HTTP/3 connection, a server can force the curl client into an infinite loop. This results in a denial of service where the application becomes unresponsive and stops processing other tasks.
Technical details
A denial of service vulnerability exists in curl's QUIC implementation (CWE-835). The root cause is located in the UDP receive helper function, which discards zero-length UDP datagrams without counting them toward the per-call packet processing budget. A malicious HTTP/3 server can exploit this by continuously streaming empty datagrams, causing the client to enter a busy-loop and indefinitely stall. This issue specifically affects platforms utilizing the recvmmsg() system call. The vulnerability was introduced in version 8.18.0 and is resolved in version 8.21.0.
Affected products
- curl curl 8.18.0 to 8.20.0
- curl libcurl 8.18.0 to 8.20.0
Timeline
- 2026-06-05: disclosed: Reported via HackerOne
- 2026-06-24: patched: Fixed in version 8.21.0
- 2026-06-24: advisory: Project advisory published
- 2026-07-03: other: NVD publication date