Log in Start free

Vulnerability · Published Feb 6, 2026 · Assigned by GitHub_M

CVE-2026-25727time affected by a stack exhaustion denial of service attack

Medium 6.8

In plain English

A medium-severity stack buffer overflow in time from time-rs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.8Medium
Exploit odds (30 days)0.3%top 73.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rust-time0.3.9-1+deb12u1DEBIAN-CVE-2026-25727
Debian:13rust-time0.3.37-1+deb13u1DEBIAN-CVE-2026-25727
Debian:14rust-time0.3.47-1DEBIAN-CVE-2026-25727
Ubuntu:22.04:LTSrust-timeno fix listedUBUNTU-CVE-2026-25727
Ubuntu:24.04:LTSrust-timeno fix listedUBUNTU-CVE-2026-25727
Ubuntu:25.10rust-timeno fix listedUBUNTU-CVE-2026-25727
Ubuntu:26.04:LTSrust-timeno fix listedUBUNTU-CVE-2026-25727

Affected products (as reported)

VendorProductVersions
time-rs time >= 0.3.6, < 0.3.47

Weakness: CWE-121 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

References