{"id":"CVE-2026-61544","title":"libp2p-rust is the official Rust language implementation of the libp2p networking stack","summary":"libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate an…","severity":"high","cvss":8.2,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":["CWE-248"],"vendor":"libp2p","product":"rust-libp2p","affected":["rust-libp2p < 0.13.1"],"patched":["libp2p-quic 0.13.1"],"published":"2026-09-15","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:16:44.627","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61544","references":[{"url":"https://github.com/libp2p/rust-libp2p/commit/212f3774af048e2cecfb2e6b1e08477685e52b22","label":"security-advisories@github.com"},{"url":"https://github.com/libp2p/rust-libp2p/commit/e8f35e12c2418b04df6e9cdf036005e8aee3c7a2","label":"security-advisories@github.com"},{"url":"https://github.com/libp2p/rust-libp2p/pull/6525","label":"security-advisories@github.com"},{"url":"https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-5hq8-qhww-jm7q","label":"security-advisories@github.com"},{"url":"https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-5hq8-qhww-jm7q","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-5hq8-qhww-jm7q"},{"url":"https://github.com/libp2p/rust-libp2p"}],"tags":["nvd","cve.org","exploit-available","ghsa","rust","osv"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-17T16:47:52.414433Z"},"cvssSource":"cna","epss":0.00231,"epssPercentile":0.14149,"aliases":["GHSA-5hq8-qhww-jm7q"],"ecosystem":"rust","ingestedAt":"2026-09-15T20:44:02.400Z","slug":"CVE-2026-61544","body":"## Overview\n\nlibp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after the certificate expired. In the Quinn post-handshake upgrade path, transports/quic/src/connection/connecting.rs called libp2p_tls::certificate::parse a second time in remote_peer_id and used expect on the result. The repeated wall-clock validity check could reject the now-expired certificate, causing the expect call to terminate any application exposing an affected libp2p-quic listener. This vulnerability is fixed in 0.13.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-61544)\n\nAffected packages:\n\n- `libp2p-quic < 0.13.1`\n\nPatched in:\n\n- `libp2p-quic 0.13.1`\n\nSource: https://github.com/advisories/GHSA-5hq8-qhww-jm7q","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":45.1,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":206466,"id":"CVE-2026-61544","ts":1789665848330,"field":"exploit_available","old":"false","new":"true"}]}