What is the CVSS score of CVE-2026-25727?

CVE-2026-25727 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Time are affected by CVE-2026-25727?

Organizations using Rust. From 0.3.6 to should be aware of notable risk from CVE-2026-25727, a stack-based buffer overflow vulnerability rated CVSS 6.5.. A patch is available.

How to fix or mitigate CVE-2026-25727?

Within 30 days: Identify affected systems running Rust. From 0.3.6 to and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Time CVE-2026-25727

MEDIUM

Stack-based Buffer Overflow (CWE-121)

2026-02-06 security-advisories@github.com

GHSA-r6v5-fh4h-64xc

Denial Of Service Time Red Hat Suse

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SUSE

MEDIUM

qualitative

Red Hat

5.9 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Feb 24, 2026 - 15:23 nvd

Patch available

CVE Published

Feb 06, 2026 - 20:16 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

AnalysisAI

The Rust time library versions 0.3.6 through 0.3.46 are vulnerable to denial of service through stack exhaustion when processing maliciously crafted RFC 2822 formatted input. An unauthenticated attacker can trigger recursive parsing of deprecated RFC 2822 features to exhaust stack memory and crash applications using affected versions. A patch implementing recursion depth limits is available in version 0.3.47 and later.

Technical ContextAI

Classified as CWE-121 (Stack-based Buffer Overflow). Affects Time. time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an er

RemediationAI

A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.

More in Time

View all

CVE-2023-28756 MEDIUM This Month

5.3 Mar 31

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. Rated medium severity (CVSS 5.3)

CVE-2020-26235 MEDIUM This Month

5.3 Nov 24

In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to derefer

Same weakness CWE-121 – Stack-based Buffer Overflow

View all

CVE-2025-0282 CRITICAL POC

9.0

CVE-2025-22457 CRITICAL POC

9.0

CVE-2012-10060 CRITICAL POC

9.3

CVE-2012-10053 CRITICAL POC

9.3

CVE-2013-10064 CRITICAL POC

9.3

CVE-2012-10023 MEDIUM POC

6.9

CVE-2012-10058 CRITICAL POC

10.0

CVE-2013-10068 CRITICAL POC

9.4

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
Container suse/manager/5.0/x86_64/server-attestation:latest	Affected
Container suse/multi-linux-manager/5.1/x86_64/server-attestation:5.1.2.8.15.2 Image server-attestation-image	Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.61	Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.28	Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.53 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.63	Affected

CVE-2026-25727 vulnerability details – vuln.today

Back

Container suse/sl-micro/6.0/toolbox:13.2-9.16	Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.86	Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.110	Affected
Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.112 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.100	Affected
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE	Affected
Image SL-Micro-BYOS-EC2 Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd	Affected
Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud	Affected
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7	Fixed
SUSE Linux Enterprise Micro 5.3	Fixed
SUSE Linux Enterprise Micro 5.4	Fixed
SUSE Linux Enterprise Micro 5.5	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7	Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7	Fixed
SUSE Linux Enterprise Module for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7	Fixed
SUSE Linux Enterprise Server 15 SP4-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP5-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS	Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP4	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP5	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Micro 6.0	Fixed
SUSE Linux Micro 6.1	Fixed
SUSE Linux Micro 6.2	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected
SUSE Linux Enterprise Server 16.0	Affected

Time CVE-2026-25727

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Time

Same weakness CWE-121 – Stack-based Buffer Overflow

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code