Cette page suit l'état du correctif pour Alpine Linux. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-11352 →
ALPINE-CVE-2026-11352
An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client....
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server
to trigger a remote denial of service against a curl or libcurl client.
Because the helper function discards zero-length UDP datagrams before counting
them toward the per-call packet budget, a connected QUIC peer can continuously
stream empty datagrams to indefinitely stall the client.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Alpine:v3.23
curl
[{"type":"ECOSYSTEM","events":[{"introduced":"8.18.0"},{"fixed":"8.22.0-r0"}]}]
Alpine:v3.24
curl
[{"type":"ECOSYSTEM","events":[{"introduced":"8.18.0"},{"fixed":"8.21.0-r0"}]}]
Références
- advisory security.alpinelinux.org