Vulnerability RUSTSEC-2026-0525

After the QUIC handshake finished, the peer's libp2p TLS certificate was parsed a second time to get its peer ID, and the result was unwrapped with expect, on the assumption that it could not fail because the certificate had already been validated. Parsing checks the certificate's validity period again against the current time. A remote peer can present a certificate that is about to expire and delay the end of the handshake until it has expired, so the second parse fails and the process panics. No authentication is needed; any application with a reachable QUIC listener is affected.

The fix returns a connection error instead of panicking when the peer identity or certificate cannot be read after the handshake. It is in 0.13.1, and was backported to the main branch in libp2p/rust-libp2p#6525 for 0.14.0.