CVE-2026-25727

Name	CVE-2026-25727
Description	time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rust-time (PTS)	bullseye	0.1.42-1	vulnerable
	bookworm	0.3.9-1	vulnerable
	trixie	0.3.37-1	vulnerable
	forky	0.3.44-1	vulnerable
	sid	0.3.47-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
rust-time	source	(unstable)	0.3.47-1

Notes

[trixie] - rust-time <no-dsa> (Minor issue)
[bookworm] - rust-time <no-dsa> (Minor issue)
https://rustsec.org/advisories/RUSTSEC-2026-0009.html
https://github.com/advisories/GHSA-r6v5-fh4h-64xc
Fixed by: https://github.com/time-rs/time/commit/1c63dc7985b8fa26bd8c689423cc56b7a03841ee (v0.3.47)