CVE-2026-61544

rust-libp2p's QUIC transport (libp2p-quic) contains a remote panic in its post-handshake upgrade path: after Quinn completes the TLS 1.3 handshake, the code re-parses the peer certificate with an expect() that assumes validation cannot fail, but the parse re-runs wall-clock validity checks. A malicious peer can present a valid but very short-lived libp2p TLS certificate, let the handshake-time validation succeed, and then withhold the final handshake fragment until just after the certificate expires but before the handshake timeout, causing the post-handshake re-parse to panic and crash the process. The attacker gains a remote, unauthenticated denial of service against any application exposing a libp2p QUIC listener, with no malformed packets required. Affected software is any Rust application using the libp2p-quic transport from rust-libp2p where a QUIC listener is reachable; exact affected version ranges were not specified in the advisory. There is no known public PoC and no indication of in-the-wild exploitation, though the flaw is trivially reachable by any network peer once the technique is known.

What to do: Upgrade rust-libp2p to the patched release containing the fix for the post-handshake certificate re-parse as soon as it is available (check the libp2p/rust-libp2p security advisories for the fixed version, as none was listed in this report). Until patched, restrict inbound QUIC (UDP) listener exposure via firewalling to known peer ranges where feasible, and run affected services under a supervisor that restarts on panic to limit downtime from crash-triggering connections. Monitor logs for panics originating in transports/quic connection upgrade code, which would indicate attempted exploitation.