Cpe:2.3:a:libp2p:libp2p-Quic:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3alibp2plibp2p-quic/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 16 Sep 2026 01:05:35 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRemote Denial of Service in libp2p-quic via Certificate Expiry Racehttps://feed.craftedsignal.io/briefs/2026-09-libp2p-quic-panic/Wed, 16 Sep 2026 01:05:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-libp2p-quic-panic/A malicious peer can trigger an application crash in libp2p-quic (< 0.13.1) by initiating a QUIC handshake and delaying the final TLS fragment until the peer certificate expires, causing an unhandled panic.The libp2p-quic crate is susceptible to a remote unauthenticated denial-of-service vulnerability (CVE-2026-61544) resulting from improper error handling during the QUIC/TLS handshake process. The vulnerability stems from a race condition where the library performs two distinct certificate validations. The first validation succeeds when the connection is established; however, a second, post-handshake validation is performed during the upgrade path. If a malicious peer presents a valid, short-lived certificate and intentionally delays sending the final TLS 1.3 handshake fragment until after the certificate's validity period has elapsed, the second validation check fails. Because the library incorrectly assumes this second parse cannot fail, it triggers an unhandled expect() call, leading to a process panic and application crash. This affects any application utilizing libp2p-quic versions prior to 0.13.1.

Attack Chain

  1. Attacker initiates a standard QUIC connection to a listener running an affected version of libp2p-quic.
  2. Attacker provides a legitimate, short-lived libp2p TLS certificate.
  3. The target's libp2p-tls component successfully parses and validates the certificate during the initial handshake.
  4. The Quinn protocol stack reports the handshake completion to the application.
  5. Attacker purposefully withholds the final client handshake fragment packet.
  6. Attacker waits until the certificate has expired while remaining within the application's QUIC handshake timeout threshold.
  7. Attacker transmits the delayed final handshake fragment to the target.
  8. The target performs the post-handshake certificate re-parse, encounters a failure due to the expired certificate, and triggers an unhandled panic.

Impact

Successful exploitation results in an immediate, remote unauthenticated denial-of-service. Because the vulnerability triggers a process-level panic, it causes an abrupt crash of the host application, potentially impacting all active connections and services handled by that instance. The attack requires no malformed packets, making it difficult to detect via traditional signature-based protocol inspection.

Recommendation

Prioritized actions for development and security teams:

  • Upgrade libp2p-quic to version 0.13.1 or later to resolve the panic condition in the connection upgrade path.
  • Audit network ingress traffic for an unusual frequency of long-duration QUIC handshakes that fail shortly after initiation.
  • Implement process monitoring to detect service restarts or crashes associated with libp2p-quic dependencies.
]]>mediumadvisorydenial-of-servicelibp2prust