CVE-2026-61544: Remote Panic in libp2p-quic via Certificate Expiry Race

Vulnerability ID: CVE-2026-61544
CVSS Score: 8.2
Published: 2026-09-15

CVE-2026-61544 is a high-severity remote Denial of Service (DoS) vulnerability in libp2p-quic, the QUIC transport implementation of the official Rust networking stack for libp2p. It allows unauthenticated remote attackers to trigger an uncaught panic and crash listener applications.

TL;DR

Unauthenticated remote attackers can crash libp2p-quic nodes by stalling handshakes with short-lived certificates that expire during the connection phase.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-248
• Attack Vector: Network (AV:N)
• CVSS Score: 8.2 (High)
• Impact: Denial of Service (Process Crash)
• Exploit Status: PoC (Integration Test Proof)
• KEV Status: Not Listed

Affected Systems

• rust-libp2p (specifically the libp2p-quic transport)
• libp2p-quic: < 0.13.1 (Fixed in: 0.13.1)

Code Analysis

Commit: 212f377

Regression test and transport logic

Commit: e8f35e1

Complete QUIC post-handshake refactoring

Mitigation Strategies

• Upgrade libp2p-quic to 0.13.1 or higher
• Implement strict rate-limiting on incoming QUIC connection attempts
• Deploy automated process recovery (e.g., systemd, Kubernetes restarts) to recover from crashes

Remediation Steps:

1. Identify cargo dependencies referencing libp2p-quic < 0.13.1
2. Update Cargo.toml to force libp2p-quic version 0.13.1 or patch via cargo update
3. Recompile the Rust application with static linking and deploy the updated binary

References

• GitHub Security Advisory GHSA-5hq8-qhww-jm7q
• Official Pull Request #6525
• Fix Commit 1 (Regression Test)
• Fix Commit 2 (QUIC Refactoring)
• CVE Registry Entry

Read the full report for CVE-2026-61544 on our website for more details including interactive diagrams and full exploit analysis.