CVE-2026-11352

CVE-2026-11352 affects curl and libcurl in the QUIC UDP receive function used during HTTP/3 sessions. A malicious HTTP/3 server can continuously stream zero-length UDP datagrams that are discarded before being counted toward the per-call packet budget, causing a busy-loop with no exit condition t...