A high-severity denial-of-service vulnerability in curl's HTTP/3 implementation could allow a remote attacker to crash client applications.

The vulnerability exists in the QUIC UDP receive function (CWE-835), where zero-length datagrams are improperly discarded, leading to an infinite loop in the packet processing logic. This requires no authentication and can be triggered by a malicious remote HTTP/3 server.

An attacker can force the client application into an infinite loop, resulting in a denial-of-service condition that consumes system resources and renders the application unresponsive. Given the CVSS score of 7.5, this poses a substantial risk to service availability for applications relying on libcurl for high-performance HTTP/3 communication.

Immediate Action: Update to the latest version of curl/libcurl once the vendor releases a patch; if HTTP/3 is not required, consider disabling it as a temporary measure.

Proactive Monitoring: Monitor for application crashes or high CPU utilization in services utilizing libcurl to communicate with external HTTP/3 endpoints.

Compensating Controls: Deploy network-level traffic inspection to identify and block malformed QUIC UDP datagrams if immediate patching is not feasible.

Public Exploit Available: No (unknown)

Availability is a core pillar of security. Organizations should monitor for vendor updates and apply the necessary patches to libcurl to prevent service disruption caused by this infinite loop condition.