GHSA-r6v5-fh4h-64xc: time fixed in 0.3.47

GHSA-r6v5-fh4h-64xc PUBLISHED CVSS 5.800000190734863 MEDIUM

time vulnerable to stack exhaustion Denial of Service attack

Record from GitHub Advisory Database · Published February 5, 2026

time is fixed in 0.3.47 (crates.io)

time vulnerable to stack exhaustion Denial of Service attack

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
time	crates.io	0.3.47
uutils	Chainguard	0.6.0-r1
ztunnel-fips-1.28	Chainguard	1.28.3-r2
uv	Chainguard	0.10.2-r1
deno	Wolfi	2.6.8-r2
wasm-pack	Chainguard	0.14.0-r3
mountpoint-s3	Wolfi	1.22.0-r3
parseable	Wolfi	2.5.11-r0
geckodriver	Chainguard	0.36.0-r5
cargo-c	Chainguard	0.10.20-r3
samply	Chainguard	0.13.1-r8
wasm-pack	Wolfi	0.14.0-r3

87 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

5.800000190734863

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H

Affected products

Vendor	Product	Versions
chainguard	uutils	0
chainguard	ztunnel-fips-1.28	0
chainguard	uv	0
wolfi	deno	0
chainguard	wasm-pack	0
wolfi	mountpoint-s3	0
wolfi	parseable	0
chainguard	geckodriver	0
chainguard	cargo-c	0
chainguard	samply	0
wolfi	wasm-pack	0
wolfi	cargo-c	0
wolfi	pixi	0
chainguard	ztunnel-1.27	0
chainguard	zola	0
chainguard	xwayland-satellite	0
chainguard	wasmcloud	0
chainguard	deno	0
chainguard	zizmor	0
wolfi	bat	0

…and 80 more

Timeline

Feb 5, 2026 CVE Published
Mar 2, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-r6v5-fh4h-64xc
vulnetix vdb fixes GHSA-r6v5-fh4h-64xc

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-r6v5-fh4h-64xc/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →