Skip to content
OpenAdvisories
High · 8.2 CVE-2026-61544 EUVD-2026-79501GHSA-5hq8-qhww-jm7q

libp2p-quic: Remote panic via certificate expiry race during QUIC handshake

Published Sep 15, 2026 · Updated Sep 17, 2026 · Assigned by GitHub_M

Description

libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after the certificate expired. In the Quinn post-handshake upgrade path, transports/quic/src/connection/connecting.rs called libp2p_tls::certificate::parse a second time in remote_peer_id and used expect on the result. The repeated wall-clock validity check could reject the now-expired certificate, causing the expect call to terminate any application exposing an affected libp2p-quic listener. This vulnerability is fixed in 0.13.1.

Affected products

VendorProductAffectedFixed
libp2p rust-libp2p < 0.13.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 26.10 rust-libp2p-identity No fix yet —
Ubuntu 26.04 LTS rust-libp2p-identity No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io libp2p-quic < 0.13.1 0.13.1 GHSA-5hq8-qhww-jm7q

References