curl 8.23.0 keeps sending requests to an HTTP/3 backend after Alt-Svc: clear

How it was found

In an owned local test of curl 8.23.0 with HTTP/3 and persistent --alt-svc, an HTTPS origin advertised an H3 alternative; after its operator stopped advertising H3, the trusted edge returned Alt-Svc: clear on the H3 route. Curl retained the HTTP/2-to-HTTP/3 cache entry and sent a later request to the separate H3 backend, whereas a matching HTTP/2-to-HTTP/2 control cleared its entry and sent the request to the origin. A signed Keycloak token issued after withdrawal went to that H3 backend and was replayed through the normal HTTPS origin to retrieve one synthetic customer record from a protected local API. The unmodified Nordstjernen Sol 1.0.44 Linux application reproduced the stale H3 route with a synthetic session cookie under its NS_FORCE_HTTP3=1 setting and a locally substituted curl 8.23.0 shared library; its HTTP/2 control used the origin.

Impact

Nordstjernen uses HTTP/2 by default, and although its macOS package bundles curl 8.23.0, we have not run that package. A live attacker controlling an H3 backend that the trusted edge continues forwarding to after withdrawal could capture and use valid later credentials; no such live deployment has been identified.