Change #278696
| Category | None |
| Changed by | Stefan Eissing <stefan@eissing.org> |
| Changed at | Tue 18 Aug 2026 08:23:01 |
| Repository | https://api.github.com/repos/curl/curl |
| Project | curl/curl |
| Branch | curl-8.20.X |
| Revision | 3b3135d9bb746127b4208f3417c752e533c1fd00 |
Comments
CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop Cherry-picked from 56eca2afb4806f1032872fa9 quic: count zero length packets against max With a flood of zero lenght UDP packets to curl, the receive loop might run longer than intended to. Count such packets against the max to terminate the loop as intended. URL: https://hackerone.com/reports/3783438 Reported-by: vectorqueue on hackerone Closes #21869
Changed files
- lib/vquic/vquic.c