https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T18:35:25.991500+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-25727 CVE-2026-25727 — time affected by a stack exhaustion denial of service attack 2026-10-04T18:35:26.010654+00:00

Affected: time-rs time

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

 https://cve.radiocsirt.org/vuln/ghsa-7gcf-g7xr-8hxj GHSA-7gcf-g7xr-8hxj — serde_with: KeyValueMap serialization panics on empty sequence or map entries 2026-10-04T18:35:26.010707+00:00

Affected: crates.io: serde_with

### Summary

The public `KeyValueMap` serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts `1` from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through `#[serde_as(as = "KeyValueMap<_>")]` can be crashed by an empty inner sequence or map entry.

### Details

The affected public surface includes:

- Serialization of `#[serde_as(as = "KeyValueMap<_>")]` values through `serde_json::to_string` or any other Serde serializer` - Public `KeyValueMap` conversions for sequence and map-backed entries`

The root cause is: The `KeyValueMap` serializer preallocating `Vec::with_capacity(len - 1)` or `Vec::with_capacity(len.unwrap_or(17) - 1)` before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> `serde_json::to_string` -> `KeyValueMap<TAs>::serialize_as` -> `SeqAsMapSerializer::{serialize_seq,serialize_map}` -> `Vec::with_capacity(len - 1)` or `Vec::with_capacity(len.unwrap_or(17) - 1)` -> panic

Relevant source locations:

- `serde_with/src/key_value_map.rs:590` - `serde_with/src/key_value_map.rs:599` - `serde_with/src/key_value_map.rs:613` - `serde_with/src/key_value_map.rs:632` - `serde_with/src/key_value_map.rs:648`

### PoC

```rust /* [dependencies] serde = {version = "*", features = ["derive"]} serde_with = "*" serde_json = "*" */

use serde::S…