Executive brief
libp2p-quic is a network transport library that handles peer-to-peer connections using the QUIC protocol. An unauthenticated remote attacker can crash any application using libp2p-quic by sending a specially timed handshake with a short-lived certificate that expires between two validation checks. This results in a denial-of-service condition affecting network availability.
Technical details
The vulnerability is a race condition in certificate validation during QUIC handshake completion. libp2p-tls validates a peer's certificate during the initial TLS handshake; after Quinn (the QUIC engine) reports handshake completion, libp2p-quic re-parses the same certificate in the post-handshake upgrade path and calls .expect() assuming it cannot fail. However, libp2p_tls::certificate::parse() re-runs full certificate verification on every call, including a wall-clock validity check against current time. A certificate valid during the first parse can expire before the second parse, causing the expect() call to panic and crash the listener. The attack requires no privilege, network reachability, and no user interaction; it only requires attacker control over TLS handshake timing. Patch: version 0.13.1 replaces the unsafe .expect() with proper error handling to gracefully reject expired certificates instead of panicking.
Affected products
- libp2p libp2p-quic < 0.13.1
Timeline
- 2026-07-10: disclosed: Published to GitHub Advisory Database
- 2026-09-15: advisory: GHSA and CVE published
References
- https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-5hq8-qhww-jm7q
- https://github.com/libp2p/rust-libp2p/pull/6525
- https://github.com/libp2p/rust-libp2p/commit/212f3774af048e2cecfb2e6b1e08477685e52b22
- https://github.com/libp2p/rust-libp2p/commit/e8f35e12c2418b04df6e9cdf036005e8aee3c7a2
- https://api.github.com/repos/libp2p/rust-libp2p/security-advisories/GHSA-5hq8-qhww-jm7q