CVE-2026-61544 libp2p-quic: Remote panic via certificate expiry race during QUIC handshake

What is CVE-2026-61544?

CVE-2026-61544 is a high-severity denial of service vulnerability in rust-libp2p, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after the certificate expired. In the Quinn post-handshake upgrade path, transports/quic/src/connection/connecting.rs called libp2p_tls::certificate::parse a second time in remote_peer_id and used expect on the result. The repeated wall-clock validity check could reject the now-expired certificate, causing the expect call to terminate any application exposing an affected libp2p-quic listener. This vulnerability is fixed in 0.13.1.

Weakness: CWE-248

Which versions are affected by CVE-2026-61544?

2 open source packages ship an affected version, including libp2p-quic.

How do I fix CVE-2026-61544?

Upgrade libp2p-quic to 0.13.1 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-61544 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61544 exists.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5hq8-qhww-jm7q, UBUNTU-CVE-2026-61544.