CVE-2026-25727 time affected by a stack exhaustion denial of service attack

What is CVE-2026-25727?

CVE-2026-25727 is a medium-severity denial of service vulnerability in time-rs time, published on 6 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

Weakness: CWE-121

Which versions are affected by CVE-2026-25727?

3 open source packages ship an affected version, including time. It affects 1 product.

Products include Time Project Time.

How do I fix CVE-2026-25727?

Upgrade time to 0.3.47 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-25727 being exploited?

There is no known exploitation of CVE-2026-25727 in the wild and no public exploit code.

Other vulnerabilities in time-rs time

• CVE-2020-26235 Segmentation fault in Rust time crate Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-76821, AZL-76994, AZL-77030, AZL-77034, AZL-77087, AZL-77091 and 64 more.