A vulnerability in libp2p-quic allows a remote peer to cause a panic during the QUIC handshake by presenting a TLS certificate that expires during the handshake process. This occurs because the certificate is parsed twice, and the second parse rechecks the certificate validity period, which can fail if the certificate expires in the interim. The issue affects all versions before 0.13.1. The vulnerability does not require authentication and affects any application with a reachable QUIC listener. A fix is available in version 0.13.1, which returns a connection error instead of panicking.