CVE-2026-25727

MEDIUM EPSS 20.8%
Published Feb 6, 20264mo ago · Modified Jun 17, 20262w ago
6.8 CVSS 4.0
Medium
Find Similar
Published Feb 6, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago

Description

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

CVSS Details

Base Score
6.8
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity High
Privileges Required Low
User Interaction A
Scope X

Threat Intelligence

EPSS Exploit Probability
20.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-121

Affected Products 1

VendorProductVersionRange
time_projecttime*≥0.3.6  –  <0.3.47

References 4

  • github.com https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05
    Release Notes
  • github.com https://github.com/time-rs/time/commit/1c63dc7985b8fa26bd8c689423cc56b7a03841ee
    Patch
  • github.com https://github.com/time-rs/time/releases/tag/v0.3.47
    ProductRelease Notes
  • github.com https://github.com/time-rs/time/security/advisories/GHSA-r6v5-fh4h-64xc
    Vendor Advisory

Remediation

  • github.com https://github.com/time-rs/time/commit/1c63dc7985b8fa26bd8c689423cc56b7a03841ee
    Patch