CVE-2026-11352

HighCVSS 7.5/10Last modified Sep 15, 2026

Description

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

No affected versions have been published.

Timeline

Published
Jul 3, 2026
Last modified
Sep 15, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-1135215.5After Effects is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker couCVE-2026-1135237.8After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the currenCVE-2026-1135257.8After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the currenCVE-2026-1135268.6After Effects is affected by a Violation of Secure Design Principles vulnerability that could result in arbitrary code execution in the contCVE-2026-1135287.8After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the currenCVE-2026-1135307.8After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the currenCVE-2026-1135328.6After Effects is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could leadCVE-2026-1135348.6After Effects is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the CVE-2026-1135367.8After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the currenCVE-2026-1135387.8After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the currenCVE-2026-1135395.5Media Encoder is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker couCVE-2026-113545.3The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3
CVE-2026-11352: High severity, CVSS 7.5 | Vulnix