CVE-2026-61544

Awaiting Analysis Awaiting Analysis - Queue

QUIC Handshake Panic in libp2p-rust

Publication date: 2026-09-15

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after the certificate expired. In the Quinn post-handshake upgrade path, transports/quic/src/connection/connecting.rs called libp2p_tls::certificate::parse a second time in remote_peer_id and used expect on the result. The repeated wall-clock validity check could reject the now-expired certificate, causing the expect call to terminate any application exposing an affected libp2p-quic listener. This vulnerability is fixed in 0.13.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-30

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-05

NVD

CVE-2026-61544

EUVD

EUVD-2026-79501

Affected Vendors & Products

Vendor	Product	Version / Range
libp2p	libp2p-quic	to 0.13.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability affects the libp2p-quic transport in the rust-libp2p library before version 0.13.1. It occurs when a remote peer presents a valid but short-lived TLS certificate that expires before the final handshake fragment is processed. The system attempts to re-validate the certificate during the post-handshake upgrade, causing a panic if the certificate has expired. This leads to application crashes instead of proper error handling.

Detection Guidance

Detecting this vulnerability requires checking if your system is running a vulnerable version of libp2p-quic (prior to 0.13.1). Use commands like 'cargo tree -p libp2p-quic' in Rust projects or inspect dependency files for versions below 0.13.1. Monitor application logs for unexpected panics during QUIC handshakes.

Impact Analysis

An unauthenticated remote attacker could exploit this to crash any application running an affected libp2p-quic listener, causing a denial-of-service condition. This means services relying on libp2p for networking could become unavailable until restarted.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by crashing applications via QUIC handshake panics, which could disrupt data processing or communication workflows. While not directly violating GDPR or HIPAA, such disruptions may impact availability of systems handling personal or health data, potentially leading to compliance issues if they prevent timely access to critical data or services.

Mitigation Strategies

Upgrade libp2p-quic to version 0.13.1 or later immediately. If using Rust projects, run 'cargo update -p libp2p-quic'. For systems exposing libp2p QUIC listeners, ensure no untrusted peers can trigger handshakes until patched. Review logs for prior crashes to assess potential exploitation.

Hi! I’m here to help you understand CVE-2026-61544. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70