libp2p‑rust2 its QUIC transport that can trigger a panic when a peer’s TLS certificate expires during the handshake. A malicious node can request a short‑lived certificate, wait until it expires, and fragment. The QUIC code parses the certificate a second time and uses an `expect` call; if the certificate is now, abruptly terminating the host process. This crash is a denial‑of‑service attack on any application listening for libp2p‑QUIC connections.

The affected product is the Rust implementation of libp2p, specifically the libp2p‑quic module in libp2p:rust-libp2p. All versions prior to 0.13.1 are vulnerable. The vulnerability is present in any Rust project that links against libp2p:rust-libp2p before 0.13.1 and exposes a QUIC listener.

The CVSS score is 8.2, classifying the vulnerability as high severity. EPSS is below 1 %, indicating a very low current probability that an attacker will successfully exploit it. It is not listed in CISA’s KEV catalog. The attack vector is remote and requires an adversary to establish a QUIC connection with a vulnerable node. Once the exploit is triggered, the remote peer causes the application to crash. There are no publicly known exploits at this time, but the low exploitation probability does not negate the need for remediation until a patch is applied.