CVE-2026-25727

Katalog CVE

CVSS 6.5 · Medium EPSS 0,34%

Kerentanan Stack-based Buffer Overflow pada time project time. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

Rincian

Terbit di NVD

6 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-121: Stack-based Buffer Overflow

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/time-rs/time/security/advisories/GHSA-r6v5-fh4h-64xc advisory vendor
• https://github.com/time-rs/time/commit/1c63dc7985b8fa26bd8c689423cc56b7a03841ee patch
• https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05 release notes
• https://github.com/time-rs/time/releases/tag/v0.3.47 product · release notes