CVE-2026-61544
HighCVSS 8.2Summary
In libp2p-rust, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after the certificate expired. In the Quinn post-handshake upgrade path, the code called libp2p_tls::certificate::parse a second time and used expect on the result; the repeated wall-clock validity check could reject the now-expired certificate, causing the expect call to terminate any application exposing an affected libp2p-quic listener. Fixed in 0.13.1.
Risk Assessment
A remote attacker can trigger a panic and terminate any application listening on libp2p-quic, causing denial of service. A single crafted inbound connection is sufficient.
Recommendation
Upgrade libp2p-rust to version 0.13.1 (or later). Until patched, consider restricting access to listening libp2p-quic ports.
Other vulnerabilities in libp2p-rust
See all- CVE-2026-33040High
In versions prior to 0.49.3, the Gossipsub implementation in libp2p-rust accepts attacker-controlled PRUNE backoff values, which may lead to time overflow and panic in the networking state machine.
- CVE-2026-34219Medium
In libp2p-rust before version 0.49.4, the Gossipsub implementation contains a remotely reachable panic in backoff expiry handling. After receiving a crafted PRUNE message with a near-maximum backoff value, the implementation performs unchecked time arithmetic, leading to overflow and panic.
Original NVD description (English source)
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after the certificate expired. In the Quinn post-handshake upgrade path, transports/quic/src/connection/connecting.rs called libp2p_tls::certificate::parse a second time in remote_peer_id and used expect on the result. The repeated wall-clock validity check could reject the now-expired certificate, causing the expect call to terminate any application exposing an affected libp2p-quic listener. This vulnerability is fixed in 0.13.1.