Most recent entries from all

bdu:2026-05136

Withdrawn: CLEANSTART-2026-BK99953 — Security fixes in ztunnel-fips 1.26.8-r1

Withdrawn by the publisher.

Affected: CleanStart: ztunnel-fips

Package ztunnel-fips version 1.26.8-r1 fixes 9 vulnerabilities: ghsa-r6v5-fh4h-64xc, ghsa-434x-w66g-qw3r, ghsa-65p9-r9h6-22vj, ghsa-hfpc-8r3f-gw53, ghsa-vw5v-4f2q-w9xf...

CVE-2026-25727 — time affected by a stack exhaustion denial of service attack

Affected: time-rs time

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

RUSTSEC-2026-0009 — Denial of Service via Stack Exhaustion

Affected: crates.io: time

## Impact

When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario.

## Patches

A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

## Workarounds

Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of the stack consumed would be at most a factor of the length of the input.