time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.
References
| Link | Resource |
|---|---|
| https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05 | Release Notes |
| https://github.com/time-rs/time/commit/1c63dc7985b8fa26bd8c689423cc56b7a03841ee | Patch |
| https://github.com/time-rs/time/releases/tag/v0.3.47 | Product Release Notes |
| https://github.com/time-rs/time/security/advisories/GHSA-r6v5-fh4h-64xc | Vendor Advisory |
Configurations
History
24 Feb 2026, 15:23
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05 - Release Notes | |
| References | () https://github.com/time-rs/time/commit/1c63dc7985b8fa26bd8c689423cc56b7a03841ee - Patch | |
| References | () https://github.com/time-rs/time/releases/tag/v0.3.47 - Product, Release Notes | |
| References | () https://github.com/time-rs/time/security/advisories/GHSA-r6v5-fh4h-64xc - Vendor Advisory | |
| First Time |
Time Project
Time Project time |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CPE | cpe:2.3:a:time_project:time:*:*:*:*:*:rust:*:* |
06 Feb 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-06 20:16
Updated : 2026-02-24 15:23
NVD link : CVE-2026-25727
Mitre link : CVE-2026-25727
CVE.ORG link : CVE-2026-25727
JSON object : View
Products Affected
time_project
- time
CWE
CWE-121
Stack-based Buffer Overflow