{"answers":{"affected":"2 open source packages ship an affected version, including libp2p-quic.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61544 exists.","fix":"Upgrade libp2p-quic to 0.13.1 or later.","what":"CVE-2026-61544 is a high-severity denial of service vulnerability in rust-libp2p, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-61544 and fix it if it is affected.\n\nWhat it is: CVE-2026-61544 is a high-severity denial of service vulnerability in rust-libp2p, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61544 exists.\n\nAffected packages and fixed versions:\n- libp2p-quic (crates.io): affected all versions; fixed in 0.13.1\n- libp2p-quic (crates.io): affected all versions; fixed in 0.13.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-61544/ (Markdown: https://insights.sbomify.com/CVE-2026-61544/index.md)","id":"CVE-2026-61544","markdown":"https://insights.sbomify.com/CVE-2026-61544/index.md","name":"CVE-2026-61544","record":{"aliases":["GHSA-5hq8-qhww-jm7q","UBUNTU-CVE-2026-61544"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Rust libp2p networking library","requires_auth":"none","summary":"A remote attacker can cause a denial of service by triggering a panic in the libp2p-quic handshake process via a race condition involving certificate expiry.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":8.2,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-248","name":"Uncaught Exception"}],"description":"libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after the certificate expired. In the Quinn post-handshake upgrade path, transports/quic/src/connection/connecting.rs called libp2p_tls::certificate::parse a second time in remote_peer_id and used expect on the result. The repeated wall-clock validity check could reject the now-expired certificate, causing the expect call to terminate any application exposing an affected libp2p-quic listener. This vulnerability is fixed in 0.13.1.","ecosystems":["crates.io"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"libp2p-quic: Remote panic via certificate expiry race during QUIC handshake","id":"CVE-2026-61544","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":2,"n_references":4,"next":{"headline":"AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools","id":"CVE-2026-61546"},"packages":[{"ecosystem":"crates.io","fixed":["0.13.1"],"introduced":["0"],"last_affected":[],"package":"libp2p-quic","purl":null,"source":"GHSA-5hq8-qhww-jm7q"},{"ecosystem":"crates.io","fixed":["0.13.1"],"introduced":["0"],"last_affected":[],"package":"libp2p-quic","purl":"pkg:cargo/libp2p-quic","source":"GHSA-5hq8-qhww-jm7q"}],"prev":{"headline":"Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools","id":"CVE-2026-61542"},"products":["rust-libp2p"],"published":"2026-09-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-17","vendors":["libp2p"]},"summary":"A remote attacker can cause a denial of service by triggering a panic in the libp2p-quic handshake process via a race condition involving certificate expiry.","url":"https://insights.sbomify.com/CVE-2026-61544/"}