Denial of Service Vulnerability in Time Library by Rust

CVE-2026-25727

What is CVE-2026-25727?

The time library in Rust, prior to version 0.3.47, is susceptible to a denial of service vulnerability due to improper handling of user-provided input conforming to the RFC 2822 format. This vulnerability arises when deprecated features of the RFC 2822 are exploited in a malicious manner, potentially leading to stack exhaustion during recursive parsing. It is important to note that conventional input does not trigger this condition. A crucial fix was introduced in version 0.3.47, which added a limit on the depth of recursion, safeguarding against this attack vector by returning an error instead of causing stack exhaustion.

References