Denial of Service in relibc via crafted input parsing

Publication date: 2026-06-26

Last updated on: 2026-06-29

Assigner: MITRE

Description

An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of Service (DoS) via parsing a crafted input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-26

Last Modified

2026-06-29

Generated

2026-07-17

AI Q&A

2026-06-27

EPSS Evaluated

2026-07-15

NVD

CVE-2026-38639

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the parse_month function within the file /time/strptime.rs of the relibc project. It allows attackers to cause a Denial of Service (DoS) by providing specially crafted input that triggers the issue during parsing.

Impact Analysis

The impact of this vulnerability is a Denial of Service (DoS), meaning that an attacker can cause the affected system or application to become unresponsive or crash by sending crafted input to the vulnerable function.

Hi! I’m here to help you understand CVE-2026-38639. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70