{"id":"CVE-2026-61544","aliases":["GHSA-5hq8-qhww-jm7q"],"url":"https://o3.security/vulnerability/CVE-2026-61544","summary":"libp2p-quic: Remote panic via certificate expiry race during QUIC handshake","details":"libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after the certificate expired. In the Quinn post-handshake upgrade path, transports/quic/src/connection/connecting.rs called libp2p_tls::certificate::parse a second time in remote_peer_id and used expect on the result. The repeated wall-clock validity check could reject the now-expired certificate, causing the expect call to terminate any application exposing an affected libp2p-quic listener. This vulnerability is fixed in 0.13.1.","published":"2026-09-15T19:46:13.721Z","modified":"2026-09-19T03:30:34.680824284Z","cvss":null,"epss":{"score":0.00231,"percentile":0.14051,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"libp2p-quic","fixedVersion":"0.13.1"}],"fix":{"url":"https://github.com/libp2p/rust-libp2p/commit/212f3774af048e2cecfb2e6b1e08477685e52b22","label":"libp2p/rust-libp2p@212f377"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61544.json"},{"type":"ADVISORY","url":"https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-5hq8-qhww-jm7q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61544"},{"type":"FIX","url":"https://github.com/libp2p/rust-libp2p/commit/212f3774af048e2cecfb2e6b1e08477685e52b22"},{"type":"FIX","url":"https://github.com/libp2p/rust-libp2p/commit/e8f35e12c2418b04df6e9cdf036005e8aee3c7a2"},{"type":"FIX","url":"https://github.com/libp2p/rust-libp2p/pull/6525"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-19T03:30:34.680824284Z"}}