CVE-2026-61544: LIBP2P Rust-LIBP2P

High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days.

libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after the certificate expired. In the Quinn post-handshake upgrade path, transports/quic/src/connection/connecting.rs called libp2p_tls::certificate::parse a second time in remote_peer_id and used expect on the result. The repeated wall-clock validity check could reject the now-expired certificate, causing the expect call to terminate any application exposing an affected libp2p-quic listener. This vulnerability is fixed in 0.13.1.

Affected products

• LIBP2P Rust-LIBP2P: before 0.13.1 (fixed in 0.13.1)

Published 2026-09-15. Last modified 2026-09-30.