CVE-2026-61544

libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after the certificate expired. In the Quinn post-handshake upgrade path, transports/quic/src/connection/connecting.rs called libp2p_tls::certificate::parse a second time in remote_peer_id and used expect on the result. The repeated wall-clock validity check could reject the now-expired certificate, causing the expect call to terminate any application exposing an affected libp2p-quic listener. This vulnerability is fixed in 0.13.1.

• CWE-248

• https://github.com/libp2p/rust-libp2p/commit/212f3774af048e2cecfb2e6b1e08477685e52b22
• https://github.com/libp2p/rust-libp2p/commit/e8f35e12c2418b04df6e9cdf036005e8aee3c7a2
• https://github.com/libp2p/rust-libp2p/pull/6525
• https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-5hq8-qhww-jm7q

Published

Sep 15, 2026

Last Modified

Sep 15, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61526AdonisJS HTTP Server is a package for handling HTTP requests…6.1
• CVE-2026-6153A vulnerability was identified in code-projects Vehicle Show…7.3
• CVE-2026-61534Yayson is a library for serializing and reading JSON API dat…9.1
• CVE-2026-61536Banks generates meaningful LLM prompts using a simple templa…7.5
• CVE-2026-61539Xinference is an inference API for running open-source, spee…10
• CVE-2026-6154A security flaw has been discovered in Totolink A7100RU 7.4c…9.8
• CVE-2026-61549Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipel…9
• CVE-2026-6155A weakness has been identified in Totolink A7100RU 7.4cu.231…9.8
• CVE-2026-61554emp3r0r is a C2 designed by Linux users for Linux environmen…7.5
• CVE-2026-61555OpenEXR is the reference implementation and specification fo…5.5
• CVE-2026-61556LiquidJS is a Shopify / GitHub Pages compatible template eng…8.7
• CVE-2026-61559`@zereight/mcp-gitlab` is a Model Context Protocol server fo…9.6