CVE-2026-61544: libp2p-quic: Remote panic via certificate expiry race during QUIC handshake
libp2p-quic can panic on an inbound QUIC handshake if a malicious peer presents a valid, short lived libp2p TLS certificate and delays the final TLS 1.3 handshake fragment until the certificate expires.
This is remotely reachable by a network peer and can crash applications exposing a libp2p QUIC listener.
References
- github.com/advisories/GHSA-5hq8-qhww-jm7q
- github.com/libp2p/rust-libp2p/commit/212f3774af048e2cecfb2e6b1e08477685e52b22
- github.com/libp2p/rust-libp2p/commit/e8f35e12c2418b04df6e9cdf036005e8aee3c7a2
- github.com/libp2p/rust-libp2p/pull/6525
- github.com/libp2p/rust-libp2p/security/advisories/GHSA-5hq8-qhww-jm7q
- nvd.nist.gov/vuln/detail/CVE-2026-61544
Code Behaviors & Features
Detect and mitigate CVE-2026-61544 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →