Reported

July 10, 2026

Issued

November 13, 2026

Package

libp2p-quic (crates.io)

Type

Vulnerability

Categories

• denial-of-service

Keywords

#libp2p #quic #tls #panic

Aliases

• CVE-2026-61544
• GHSA-5hq8-qhww-jm7q

References

• https://github.com/libp2p/rust-libp2p/commit/212f3774af048e2cecfb2e6b1e08477685e52b22
• https://github.com/libp2p/rust-libp2p/pull/6525

Patched

• >=0.13.1

Description

After the QUIC handshake finished, the peer's libp2p TLS certificate was parsed a second time to get its peer ID, and the result was unwrapped with expect, on the assumption that it could not fail because the certificate had already been validated. Parsing checks the certificate's validity period again against the current time. A remote peer can present a certificate that is about to expire and delay the end of the handshake until it has expired, so the second parse fails and the process panics. No authentication is needed; any application with a reachable QUIC listener is affected.

The fix returns a connection error instead of panicking when the peer identity or certificate cannot be read after the handshake. It is in 0.13.1, and was backported to the main branch in libp2p/rust-libp2p#6525 for 0.14.0.

Advisory available under CC0-1.0 license.