RUSTSEC-2026-0009

    Dashboard / Vulnerabilities / RUSTSEC-2026-0009

    RUSTSEC-2026-0009

    Published: 5 Feb 2026Last Modified: 6 Feb 2026

    Summary: Denial of Service via Stack Exhaustion

    Details: ## Impact When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. ## Patches A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack. ## Workarounds Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of the stack consumed would be at most a factor of the length of the input.

    References: https://crates.io/crates/time, https://rustsec.org/advisories/RUSTSEC-2026-0009.html, https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05

    Affected packages

    Package

    Name: time

    Purl: pkg:cargo/time

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.3.6
    Fixed -0.3.47

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    RUSTSEC-2026-0009 | CVE-DB