{"metadata": {"vulnerability": "CVE-2026-61544", "count": 15, "kinds": {"milestone": 5, "sighting": 2, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-07-10T16:27:03.093Z", "date_only": false, "value": "2026-07-10T16:27:03.093Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-61544", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-15T19:46:13.721Z", "date_only": false, "value": "2026-09-15T19:46:13.721Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61544", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-15T19:46:13.721Z", "date_only": false, "value": "2026-09-15T19:46:13.721Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-61544", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-15T20:01:17Z", "date_only": false, "value": "2026-09-15T20:01:17Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5HQ8-QHWW-JM7Q", "record": "GHSA-5HQ8-QHWW-JM7Q", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-15T20:01:17Z", "date_only": false, "value": "2026-09-15T20:01:17Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-5HQ8-QHWW-JM7Q", "record": "GHSA-5HQ8-QHWW-JM7Q", "field": "modified"}, {"timestamp": "2026-09-15T20:17:00Z", "date_only": false, "value": "2026-09-15T20:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-61544", "record": "UBUNTU-CVE-2026-61544", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-15T20:17:35.147Z", "date_only": false, "value": "2026-09-15T20:17:35.147", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61544", "record": "FKIE_CVE-2026-61544", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-15T22:35:07.183Z", "date_only": false, "value": "2026-09-15T22:35:07.183908Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-5hq8-qhww-jm7q", "record": "CVE-2026-61544", "field": "creation_timestamp", "uuid": "9c9ec749-b585-457d-8d53-0b6b9c5deb71", "url": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-5hq8-qhww-jm7q", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-16T07:35:07.713Z", "date_only": false, "value": "2026-09-16T07:35:07.713229Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/013ea36d9ece4cb8727c52246b863fd0", "record": "CVE-2026-61544", "field": "creation_timestamp", "uuid": "a2eb0d6f-1c54-40b8-a5e7-68d9f95ca01d", "content": "# CVE-2026-61544: CVE-2026-61544: Remote Panic in libp2p-quic via Certificate Expiry Race\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-09-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61544\n\n## Summary\nCVE-2026-61544 is a high-severity remote Denial of Service (DoS) vulnerability in libp2p-quic, the QUIC transport implementation of the official Rust networking stack for libp2p. It allows unauthenticated remote attackers to trigger an uncaught panic and crash listener applications.\n\n## TL;DR\nUnauthenticated remote attackers can crash libp2p-quic nodes by stalling handshakes with short-lived certificates that expire during the connection phase.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-248\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.2 (High)\n- **Impact**: Denial of Service (Process Crash)\n- **Exploit Status**: PoC (Integration Test Proof)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- rust-libp2p (specifically the libp2p-quic transport)\n- **libp2p-quic**: < 0.13.1 (Fixed in: `0.13.1`)\n\n## Mitigation\n\n- Upgrade libp2p-quic to 0.13.1 or higher\n- Implement strict rate-limiting on incoming QUIC connection attempts\n- Deploy automated process recovery (e.g., systemd, Kubernetes restarts) to recover from crashes\n\n**Remediation Steps:**\n1. Identify cargo dependencies referencing libp2p-quic < 0.13.1\n2. Update Cargo.toml to force libp2p-quic version 0.13.1 or patch via cargo update\n3. Recompile the Rust application with static linking and deploy the updated binary\n\n## References\n\n- [GitHub Security Advisory GHSA-5hq8-qhww-jm7q](https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-5hq8-qhww-jm7q)\n- [Official Pull Request #6525](https://github.com/libp2p/rust-libp2p/pull/6525)\n- [Fix Commit 1 (Regression Test)](https://github.com/libp2p/rust-libp2p/commit/212f3774af048e2cecfb2e6b1e08477685e52b22)\n- [Fix Commit 2 (QUIC Refactoring)](https://github.com/libp2p/rust-libp2p/commit/e8f35e12c2418b04df6e9cdf036005e8aee3c7a2)\n- [CVE Registry Entry](https://www.cve.org/CVERecord?id=CVE-2026-61544)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61544) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/013ea36d9ece4cb8727c52246b863fd0"}, {"timestamp": "2026-09-17T16:47:52.414Z", "date_only": false, "value": "2026-09-17T16:47:52.414433Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-61544", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-17T16:47:52.414Z", "date_only": false, "value": "2026-09-17T16:47:52.414433Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61544", "record": "FKIE_CVE-2026-61544", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-17T16:48:19.068Z", "date_only": false, "value": "2026-09-17T16:48:19.068Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-61544", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-17T16:48:19.068Z", "date_only": false, "value": "2026-09-17T16:48:19.068Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-61544", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-30T17:51:36.337Z", "date_only": false, "value": "2026-09-30T17:51:36.337", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61544", "record": "FKIE_CVE-2026-61544", "field": "lastModified"}, {"timestamp": "2026-10-17T09:46:01Z", "date_only": false, "value": "2026-10-17T09:46:01Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-61544", "record": "UBUNTU-CVE-2026-61544", "field": "modified"}], "metrics": {"as_of": "2026-11-02T20:08:55.615Z", "anchors": {"origin": {"timestamp": "2026-09-15T19:46:13.721Z", "date_only": false, "value": "2026-09-15T19:46:13.721Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61544", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-09-15T19:46:13.721Z", "date_only": false, "value": "2026-09-15T19:46:13.721Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61544", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-09-15T22:35:07.183Z", "date_only": false, "value": "2026-09-15T22:35:07.183908Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-5hq8-qhww-jm7q", "record": "CVE-2026-61544", "field": "creation_timestamp", "uuid": "9c9ec749-b585-457d-8d53-0b6b9c5deb71", "url": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-5hq8-qhww-jm7q", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 10133.462, "hours": 2.8148505555555556, "days": 0.1172854398148148, "min_seconds": 10133.462, "max_seconds": 10133.462, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-15T19:46:13.721Z", "date_only": false, "value": "2026-09-15T19:46:13.721Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61544", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-09-15T22:35:07.183Z", "date_only": false, "value": "2026-09-15T22:35:07.183908Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-5hq8-qhww-jm7q", "record": "CVE-2026-61544", "field": "creation_timestamp", "uuid": "9c9ec749-b585-457d-8d53-0b6b9c5deb71", "url": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-5hq8-qhww-jm7q", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 4148561.894422, "hours": 1152.378304006111, "days": 48.0157626669213, "min_seconds": 4148561.894422, "max_seconds": 4148561.894422, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-15T19:46:13.721Z", "date_only": false, "value": "2026-09-15T19:46:13.721Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61544", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-02T20:08:55.615Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 4138428.432422, "hours": 1149.5634534505555, "days": 47.89847722710648, "min_seconds": 4138428.432422, "max_seconds": 4138428.432422, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-15T22:35:07.183Z", "date_only": false, "value": "2026-09-15T22:35:07.183908Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-5hq8-qhww-jm7q", "record": "CVE-2026-61544", "field": "creation_timestamp", "uuid": "9c9ec749-b585-457d-8d53-0b6b9c5deb71", "url": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-5hq8-qhww-jm7q", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-02T20:08:55.615Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}