GHSA-r6v5-fh4h-64xc

Source

https://github.com/advisories/GHSA-r6v5-fh4h-64xc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-r6v5-fh4h-64xc/GHSA-r6v5-fh4h-64xc.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-r6v5-fh4h-64xc

Aliases

Downstream

CGA (127)

MINI (14)

Published

2026-02-05T17:57:55Z

Modified

2026-07-17T21:09:09Z

Severity

6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H CVSS Calculator

Summary

time vulnerable to stack exhaustion Denial of Service attack

Details

Impact

When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario.

Patches

A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

Workarounds

Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of the stack consumed would be at most a factor of the length of the input.

Alternatively, avoiding the format altogether would also ensure that the vulnerability is not encountered. To do this, add

disallowed-types = ["time::format_description::well_known::Rfc2822"]

to your clippy.toml file. This will trigger the clippy::disallowed_types lint, which is warn-by-default and can be explicitly denied.

Database specific

{
    "cwe_ids": [
        "CWE-121"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-05T17:57:55Z",
    "nvd_published_at": "2026-02-06T20:16:11Z",
    "severity": "MODERATE"
}

References

Affected packages

crates.io / time

Package

Name: time; View open source insights on deps.dev
Purl: pkg:cargo/time

Affected ranges

Type: SEMVER
Events: Introduced

0.3.6

Fixed

0.3.47

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-r6v5-fh4h-64xc/GHSA-r6v5-fh4h-64xc.json"