[rpms/curl] f44: Resolves: CVE-2026-11352 - QUIC zero-length UDP datagrams busy-loop

[Jan Macku <jamacku@redhat.com>]

A new commit has been pushed.

Repo   : rpms/curl
Branch : f44
Commit : 9ed2e194c55e2475b47ed00a91a2221d14485a7e
Author : Jan Macku <jamacku@redhat.com>
Date   : 2026-08-24T12:49:48+02:00
Stats  : +56/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/curl/c/9ed2e194c55e2475b47ed00a91a2221d14485a7e?branch=f44

Log:
Resolves: CVE-2026-11352 - QUIC zero-length UDP datagrams busy-loop

---
diff --git a/0013-curl-8.18.0-CVE-2026-11352.patch b/0013-curl-8.18.0-CVE-2026-11352.patch
new file mode 100644
index 0000000..8622983
--- /dev/null
+++ b/0013-curl-8.18.0-CVE-2026-11352.patch
@@ -0,0 +1,49 @@
+From f6b3d1ae69385011555fd75a2a276ba6240d501f Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Fri, 5 Jun 2026 08:34:46 +0200
+Subject: [PATCH] quic: count zero length packets against max
+
+With a flood of zero lenght UDP packets to curl, the receive loop might
+run longer than intended to. Count such packets against the max to
+terminate the loop as intended.
+
+URL: https://hackerone.com/reports/3783438
+Reported-by: vectorqueue on hackerone
+Closes #21869
+
+(cherry picked from commit 56eca2afb4806f1032872fa97d1834b3c1385276)
+---
+ lib/vquic/vquic.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/lib/vquic/vquic.c b/lib/vquic/vquic.c
+index d7bfa99104..f455fe41f8 100644
+--- a/lib/vquic/vquic.c
++++ b/lib/vquic/vquic.c
+@@ -448,8 +448,10 @@ static CURLcode recvmmsg_packets(struct Curl_cfilter *cf,
+     ++calls;
+     for(i = 0; i < mcount; ++i) {
+       /* A zero-length UDP packet is no QUIC packet. Ignore. */
+-      if(!mmsg[i].msg_len)
++      if(!mmsg[i].msg_len) {
++        ++pkts;
+         continue;
++      }
+       total_nread += mmsg[i].msg_len;
+ 
+       gso_size = vquic_msghdr_get_udp_gro(&mmsg[i].msg_hdr);
+@@ -532,8 +534,10 @@ static CURLcode recvmsg_packets(struct Curl_cfilter *cf,
+     ++calls;
+ 
+     /* A 0-length UDP packet is no QUIC packet */
+-    if(!nread)
++    if(!nread) {
++      ++pkts;
+       continue;
++    }
+ 
+     gso_size = vquic_msghdr_get_udp_gro(&msg);
+     if(gso_size == 0)
+-- 
+2.55.0
+

diff --git a/curl.spec b/curl.spec
index 5ff27e1..e75ab49 100644
--- a/curl.spec
+++ b/curl.spec
@@ -12,7 +12,7 @@
 Summary: A utility for getting files from remote servers (FTP, HTTP, and others)
 Name: curl
 Version: 8.18.0
-Release: 8%{?dist}
+Release: 9%{?dist}
 License: curl
 Source0: https://curl.se/download/%{name}-%{version_no_tilde}.tar.xz
 Source1: https://curl.se/download/%{name}-%{version_no_tilde}.tar.xz.asc
@@ -60,6 +60,9 @@ Patch011: 0011-curl-8.18.0-CVE-2026-7168.patch
 # Fix OCSP stapling bypass with Apple SecTrust (CVE-2026-7009)
 Patch012: 0012-curl-8.18.0-CVE-2026-7009.patch
 
+# Fix QUIC zero-length UDP datagrams busy-loop (CVE-2026-11352)
+Patch013: 0013-curl-8.18.0-CVE-2026-11352.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -483,6 +486,9 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
 %{_libdir}/libcurl.so.4.[0-9].[0-9].minimal
 
 %changelog
+* Mon Aug 24 2026 Jan Macku <jamacku@redhat.com> - 8.18.0-9
+- Fix QUIC zero-length UDP datagrams busy-loop (CVE-2026-11352)
+
 * Wed Jul 29 2026 Jan Macku <jamacku@redhat.com> - 8.18.0-8
 - Fix trailing dot domain super cookie (CVE-2026-8924)
 - Fix SSH improper host validation (CVE-2026-9547)