CVE-2026-0810
High · 7.1CVSS
7.1
EPSS
0.2%
Published
Jan 26, 2026
CISA due date
—
The record
A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the `TimeBuf` component, leading to undefined behavior when these malformed strings are subsequently processed. This could potentially result in application instability or other unforeseen consequences.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | gix-date | 0 | 0.12.0 |
| crates.io | gix-date | 0.0.0-0 | 0.12.0 |
| Chainguard | cargo-audit | 0 | 0.22.1-r0 |
| Chainguard | cargo-c | 0 | 0.10.21-r0 |
| Chainguard | jujutsu | 0 | 0.37.0-r0 |
| Chainguard | jujutsu-docs | 0 | 0.36.0-r0 |
| Chainguard | watchexec | 0 | 2.3.3-r0 |
| Wolfi | cargo-audit | 0 | 0.22.1-r0 |
| Wolfi | cargo-c | 0 | 0.10.21-r0 |
Related vulnerabilities
- RUSTSEC-2025-0140 Non-utf8 String can be created with `TimeBuf::as_str` Same vulnerability
- GHSA-8rgq-m2pm-jvmg Duplicate Advisory: gix-date can create non-utf8 string with `TimeBuf::as_str` Also affects gix-date
- CVE-2026-31812 Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Also affects cargo-audit
- CVE-2026-25727 time provides date and time handling in Rust. Also affects cargo-audit
- CVE-2026-25541 Bytes is a utility library for working with bytes. Also affects cargo-audit
- CVE-2024-12224 `idna` accepts Punycode labels that do not produce any non-ASCII when decoded Also affects cargo-audit
- CVE-2024-45405 `gix-path` is a crate of the `gitoxide` project (an implementation of `git` written in… Also affects cargo-audit
- CVE-2024-45305 gix-path is a crate of the gitoxide project dealing with git paths and their conversions. Also affects cargo-audit