Vulnerability MediumRUSTSEC-2026-0009 · time
RUSTSEC-2026-0009: Denial of Service via Stack Exhaustion
Short answerA security vulnerability in the time crate: Denial of Service via Stack Exhaustion. GitHub rates it Medium. Fixed in 0.3.47: update to a fixed version.
| Crate | time |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | From 0.3.6 before 0.3.47. |
| Fixed in | 0.3.47 |
| Severity | Medium (GitHub rating) CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H |
| Published | 2026-02-05 |
| Last changed | 2026-02-06 |
| Also known as | CVE-2026-25727, GHSA-r6v5-fh4h-64xc |
| Affected functions | time::Date::parse, time::OffsetDateTime::parse, time::PrimitiveDateTime::parse, time::Time::parse, time::UtcDateTime::parse, time::UtcOffset::parse, time::parsing::Parsed::parse_item |
What to do
- See which version you have:
cargo tree -i time(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p time. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampletime = "0.3.47") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Impact
When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario.
Patches
A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.
Workarounds
Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of the stack consumed would be at most a factor of the length of the input.
References
- Package: crates.io/crates/time
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0009.html
- Web: github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for time
Up next
Same cratetime: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?