{"vulnerability": "CVE-2026-6154", "sightings": [{"uuid": "9c902307-ad2d-48e4-a899-c54b55837b1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6154", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mje623ywvn2h", "content": "", "creation_timestamp": "2026-04-13T05:46:14.558437Z"}, {"uuid": "f41425ad-23fc-487a-8270-9a437d3cd270", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6154", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mje6gzexfv2x", "content": "", "creation_timestamp": "2026-04-13T05:53:27.613605Z"}, {"uuid": "4736a36d-af1d-4ea2-8a1d-a772ae698470", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-6154", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116396223859537831", "content": "", "creation_timestamp": "2026-04-13T07:30:29.241716Z"}, {"uuid": "ef75ae63-1ca8-4bfb-b87b-4ed25bc2311e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-6154", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mjedujyz2u2p", "content": "", "creation_timestamp": "2026-04-13T07:30:30.960048Z"}, {"uuid": "d23a7bad-2e8f-45cb-a222-d2912a909c4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6154", "type": "published-proof-of-concept", "source": "Telegram/38C7MAAhnpHd5NceA_wXcFYw5n56xIYZ8i0J7F3P3Z_bI98", "content": "", "creation_timestamp": "2026-04-13T05:18:10.000000Z"}, {"uuid": "a456dc9f-4861-4e90-a5f8-c1107638a749", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61545", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3msg4i4smu425", "content": "\ud83d\udd17 CVE : CVE-2026-61527, CVE-2026-61545", "creation_timestamp": "2026-08-06T13:10:21.848197Z"}, {"uuid": "93f9fee1-9ca3-42bd-aaf1-bc346fab2b38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61548", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mr3trxldl322", "content": "CVE-2026-61548: rsyslog mmpstrucdata stack overflow", "creation_timestamp": "2026-07-20T17:42:58.596301Z"}, {"uuid": "7b15120b-4dd7-462c-8c98-8ff22591f448", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61549", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvkxipc4tt2g", "content": "CVE-2026-61549 - woodpecker\nVersions 1.0.0 through 3.16.0 of Woodpecker let anyone who can push code to a linked repository tell the system to run its build jobs using any service account in\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#woodpecker #woodpeckerci #Golang #CVE #infosec", "creation_timestamp": "2026-09-15T15:40:05.876314Z"}, {"uuid": "9c9ec749-b585-457d-8d53-0b6b9c5deb71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-61544", "type": "published-proof-of-concept", "source": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-5hq8-qhww-jm7q", "content": "", "creation_timestamp": "2026-09-15T22:35:07.183908Z"}, {"uuid": "a2eb0d6f-1c54-40b8-a5e7-68d9f95ca01d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61544", "type": "seen", "source": "https://gist.github.com/alon710/013ea36d9ece4cb8727c52246b863fd0", "content": "# CVE-2026-61544: CVE-2026-61544: Remote Panic in libp2p-quic via Certificate Expiry Race\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-09-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61544\n\n## Summary\nCVE-2026-61544 is a high-severity remote Denial of Service (DoS) vulnerability in libp2p-quic, the QUIC transport implementation of the official Rust networking stack for libp2p. It allows unauthenticated remote attackers to trigger an uncaught panic and crash listener applications.\n\n## TL;DR\nUnauthenticated remote attackers can crash libp2p-quic nodes by stalling handshakes with short-lived certificates that expire during the connection phase.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-248\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.2 (High)\n- **Impact**: Denial of Service (Process Crash)\n- **Exploit Status**: PoC (Integration Test Proof)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- rust-libp2p (specifically the libp2p-quic transport)\n- **libp2p-quic**: < 0.13.1 (Fixed in: `0.13.1`)\n\n## Mitigation\n\n- Upgrade libp2p-quic to 0.13.1 or higher\n- Implement strict rate-limiting on incoming QUIC connection attempts\n- Deploy automated process recovery (e.g., systemd, Kubernetes restarts) to recover from crashes\n\n**Remediation Steps:**\n1. Identify cargo dependencies referencing libp2p-quic < 0.13.1\n2. Update Cargo.toml to force libp2p-quic version 0.13.1 or patch via cargo update\n3. Recompile the Rust application with static linking and deploy the updated binary\n\n## References\n\n- [GitHub Security Advisory GHSA-5hq8-qhww-jm7q](https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-5hq8-qhww-jm7q)\n- [Official Pull Request #6525](https://github.com/libp2p/rust-libp2p/pull/6525)\n- [Fix Commit 1 (Regression Test)](https://github.com/libp2p/rust-libp2p/commit/212f3774af048e2cecfb2e6b1e08477685e52b22)\n- [Fix Commit 2 (QUIC Refactoring)](https://github.com/libp2p/rust-libp2p/commit/e8f35e12c2418b04df6e9cdf036005e8aee3c7a2)\n- [CVE Registry Entry](https://www.cve.org/CVERecord?id=CVE-2026-61544)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61544) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T07:35:07.713229Z"}]}