CVE-2026-61544High· 8.2▾ MidnightPoC availablelibp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate an…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 45.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Exploit / PoC code exists
0.2% → 0.3%
Last analysed / modified upstream
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after the certificate expired. In the Quinn post-handshake upgrade path, transports/quic/src/connection/connecting.rs called libp2p_tls::certificate::parse a second time in remote_peer_id and used expect on the result. The repeated wall-clock validity check could reject the now-expired certificate, causing the expect call to terminate any application exposing an affected libp2p-quic listener. This vulnerability is fixed in 0.13.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
libp2p-quic < 0.13.1Patched in:
libp2p-quic 0.13.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-89146High· 7.5libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow
CVE-2026-95859High· 8.7libp2p-rust: Gossipsub GRAFT topics unbounded growth
CVE-2026-103936High· 7.5libp2p is a JavaScript implementation of the libp2p networking stack
CVE-2026-115892Medium· 5.7Panic lowering a host-created component model stream into a guest that expects a different payload type
CVE-2026-97394High· 7.5kin-openapi is a Go project for handling OpenAPI files
CVE-2026-100347Medium· 5.3kin-openapi is a Go project for handling OpenAPI files