TLS Certificate Handling Vulnerability in libp2p Networking Stack by libp2p
CVE-2026-61544

8.2HIGH

Key Information:

Vendor

Libp2p

Status
Rust-libp2p
Vendor
CVE Published:
15 September 2026

What is CVE-2026-61544?

The libp2p networking stack's Rust implementation faced a vulnerability prior to version 0.13.1, where libp2p-quic could crash due to improper handling of TLS certificates during QUIC handshake processes. Specifically, if a remote peer presented a valid, but short-lived, TLS certificate and delayed the handshake completion until after the certificate had expired, the system could execute a second validity check. This led to a failure in accepting the now-expired certificate and caused application crashes exposing an affected libp2p-quic listener. The issue has since been addressed in version 0.13.1.

Affected Version(s)

rust-libp2p < 0.13.1

References

https://github.com/libp2p/rust-libp2p/security/advisories...
x_refsource_CONFIRM
https://github.com/libp2p/rust-libp2p/pull/6525
x_refsource_MISC
https://github.com/libp2p/rust-libp2p/commit/212f3774af04...
x_refsource_MISC

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.