date-and-time is a package for manipulating date and time. In date-and-time before version 0.14.2, there a regular expression involved in parsing which can be exploited to to cause a denial of service.

Upgrade to version version 0.14.2 or later.