What is the CVSS score of CVE-2026-38639?

CVE-2026-38639 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of N A are affected by CVE-2026-38639?

relibc (Redox OS C standard library) contains a denial-of-service vulnerability in the strptime() function that crashes applications when processing crafted time strings.

Is there a public PoC exploit available for CVE-2026-38639?

Yes, a public proof-of-concept exploit is available for CVE-2026-38639. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-38639?

Within 24 hours, identify all Redox OS systems and applications in your environment and assess whether they process untrusted time input. Within 7 days, implement input validation and sanitization for time-string parameters before calling strptime(), deploy monitoring for abnormal application crashes, and document the vulnerability in your risk register. Within 30 days, continue monitoring Redox OS security advisories for a released patch, evaluate alternative C libraries or architecture changes if operationally feasible, and maintain a test environment ready to deploy patches once available.

N A CVE-2026-38639

HIGH

Improper Input Validation (CWE-20)

2026-06-26 mitre

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:11 vuln.today

CVE Published

Jun 26, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Jun 26, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of Service (DoS) via parsing a crafted input.

AnalysisAI

Denial of service in relibc — the Redox OS C standard library implemented in Rust — allows attackers to crash applications by supplying a crafted time string to strptime(), which mishandles month parsing in the parse_month function of time/strptime.rs at commit ab6a2e. Publicly available exploit code exists (a dedicated PoC in the Marsman1996 repository), though there is no evidence of active exploitation; the EPSS score is low at 0.17% (6th percentile). Impact is availability-only (application crash/hang) with no confidentiality or integrity loss.