Description
In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the affected functions. The affected functions are time::UtcOffset::local_offset_at, time::UtcOffset::try_local_offset_at, time::UtcOffset::current_local_offset, time::UtcOffset::try_current_local_offset, time::OffsetDateTime::now_local and time::OffsetDateTime::try_now_local. Non-Unix targets are unaffected. This includes Windows and wasm. The issue was introduced in version 0.2.7 and fixed in version 0.2.23.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| time-rs | time | >= 0.2.7, <0.2.23 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-time | No fix yet | — |
| Ubuntu 26.04 LTS | rust-time | No fix yet | — |
| Ubuntu 25.10 | rust-time | No fix yet | — |
| Ubuntu 24.04 LTS | rust-time | No fix yet | — |
| Ubuntu 22.04 LTS | rust-time | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | rust-time | No fix yet | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | newsboat | 2.30.1-r0 | — |
| Alpine v3.23 | newsboat | 2.30.1-r0 | — |
| Alpine v3.22 | newsboat | 2.30.1-r0 | — |
| Alpine v3.21 | newsboat | 2.30.1-r0 | — |
| Alpine v3.20 | newsboat | 2.30.1-r0 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | newsboat | 2.30.1-r0 | — |
| Alpine v3.18 | newsboat | 2.30.1-r0 | — |
| Alpine v3.17 | newsboat | 2.30.1-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | berg | 0.4.7-r0 | — |
| Wolfi rolling | pgcat | No fix yet | — |
| Wolfi rolling | pulumi-watch | 0.1.5-r5 | — |
| Wolfi rolling | zellij +3 | 0.41.2-r2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
federiconbaez/cortex9-time-crate-env-race-interleaving-model ★ 0 · Nov 6, 2026
Finite interleaving model of time 0.2.22 tzset/getenv vs setenv realloc (CVE-2020-26235). No threads, libc or real environment.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | time | >= 0.1.0, < 0.2.23 | 0.2.23 | GHSA-wcg3-cvx6-7396 |
| crates.io | time | >= 0.2.7, < 0.2.23 | 0.2.23 | GHSA-wcg3-cvx6-7396 |
| crates.io | time | >= 0.0.0-0, < 0.2.0 · >= 0.2.1-0, < 0.2.1 · >= 0.2.2-0, < 0.2.2 · >= 0.2.3-0, < 0.2.3 · >= 0.2.4-0, < 0.2.4 · >= 0.2.5-0, < 0.2.5 · >= 0.2.6-0, < 0.2.6 · >= 0.2.7-0, < 0.2.23 | 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.23 | RUSTSEC-2020-0071 |