Description
An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- curl / curl8.20.0 – 8.20.0
- curl / curl8.19.0 – 8.19.0
- curl / curl8.18.0 – 8.18.0
- curl / curl8.18.0 – 8.20.1
- curl / curl6a3d0b6d631d5e9bec797306b5b41a9f440a088d – 56eca2afb4806f1032872fa97d1834b3c1385276
- haxx / curl8.18.0 – 8.21.0
Updated 44m ago · 8 sources