[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-11352":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T11:19:25.255Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":11,"aliases":12,"duplicate_of":9,"upstream":13,"downstream":14,"duplicates":29,"related":30,"reserved_at":9,"published_at":32,"modified_at":33,"state":34,"summary":35,"references_raw":44,"kevs":57,"epss":58,"epss_history":61,"metrics":66,"affected":72},"CVE-2026-11352","An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server\nto trigger a remote denial of service against a curl or libcurl client.\nBecause the helper function discards zero-length UDP datagrams before counting\nthem toward the per-call packet budget, a connected QUIC peer can continuously\nstream empty datagrams to indefinitely stall the client.",null,[],[],[],[],[15,17,19,21,23,25,27],{"_key":16},"ALPINE-CVE-2026-11352",{"_key":18},"USN-8525-1",{"_key":20},"DEBIAN-CVE-2026-11352",{"_key":22},"OPENSUSE-SU-2026:11230-1",{"_key":24},"RHSA-2026:29017",{"_key":26},"RHSA-2026:34975",{"_key":28},"UBUNTU-CVE-2026-11352",[],[31],{"_key":22},"2026-07-03T06:12:10.777Z","2026-07-06T18:27:49.432Z","PUBLISHED",{"cisa_kev":36,"cisa_ransomware":36,"cisa_vendor":9,"epss_severity":37,"epss_score":38,"severity":39,"severity_score":40,"severity_version":41,"severity_source":42,"severity_vector":43,"severity_status":34},false,"low",0.0028,"high",7.5,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",[45,49,53],{"url":46,"sources":47,"tags":48},"https://curl.se/docs/CVE-2026-11352.json",[42],[],{"url":50,"sources":51,"tags":52},"https://curl.se/docs/CVE-2026-11352.html",[42],[],{"url":54,"sources":55,"tags":56},"https://hackerone.com/reports/3783438",[42],[],[],{"date":59,"score":38,"percentile":60},"2026-07-05",0.19844,[62,65],{"date":63,"score":38,"percentile":64},"2026-07-04",0.19836,{"date":59,"score":38,"percentile":60},[67],{"source":42,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":68,"cvss_v4_0":9},{"baseScore":40,"baseSeverity":69,"vectorString":43,"impactScore":70,"exploitabilityScore":71},"HIGH",6,10,[73],{"ecosystem":9,"name":74,"vendor":74,"product":74,"cpe_part":75,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":76},"curl","a",[77,82,85],{"version":78,"is_range":79,"range_type":42,"version_start":80,"version_start_type":81,"version_end":80,"version_end_type":81,"fixed_in":9},">= 8.20.0, \u003C= 8.20.0",true,"8.20.0","including",{"version":83,"is_range":79,"range_type":42,"version_start":84,"version_start_type":81,"version_end":84,"version_end_type":81,"fixed_in":9},">= 8.19.0, \u003C= 8.19.0","8.19.0",{"version":86,"is_range":79,"range_type":42,"version_start":87,"version_start_type":81,"version_end":87,"version_end_type":81,"fixed_in":9},">= 8.18.0, \u003C= 8.18.0","8.18.0"]