Curl’s QUIC UDP receive routine miscounts zero‑length UDP packets, discarding them before accounting for them in the per‑call packet budget, which allows a malicious HTTP/3 server to continuously stream empty datagrams to a curl or libcurl client, causing the client to spin and consume CPU resources indefinitely. The flaw is a classic maximum iteration count issue (CWE‑835) and does not grant code execution or data exfiltration.

The vulnerability impacts all instances of the curl command line tool and libcurl library where QUIC support is compiled in. Because the advisory does not specify affected versions, any current release that enables QUIC handling is potentially vulnerable until a patch is applied. The CVE payload does not provide affected version information.

The EPSS score of 1% indicates a low but non‑zero likelihood of exploitation, and the attack path is straightforward: an attacker only needs to control a QUIC endpoint and send zero‑length UDP datagrams. No authentication or elevated privileges are required on the client side. The CVSS score of 7.5 reflects high severity for a remote denial of service, and the vulnerability is not listed in CISA’s KEV catalog, but it can cause significant service interruption for clients that rely on HTTP/3 traffic.