CVE-2026-60075

Deferred Deferred - Pending Action

CPU Exhaustion in Date::Manip Perl Module

Publication date: 2026-07-30

Last updated on: 2026-07-31

Assigner: CPANSec

Description

Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes. Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-31

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-60075

EUVD

EUVD-2026-51125

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial-of-service issue in Date::Manip versions through 6.99 for Perl. It occurs because the _parse_time function uses an inefficient regex pattern that causes CPU exhaustion when processing long runs of whitespace. The regex engine repeatedly backtracks across the whitespace, leading to quadratic time complexity and excessive CPU usage even when no valid time is present in the string.

Detection Guidance

To detect this vulnerability, monitor CPU usage spikes when processing strings with long whitespace runs in Perl scripts using Date::Manip. Test with inputs like 2000 or 16000 spaces to observe excessive parsing time. Use system monitoring tools like top or htop to track CPU consumption during such operations.

Impact Analysis

If you use Date::Manip in your Perl application and pass untrusted input with long whitespace runs to functions like ParseDate() or parse_time(), an attacker could exploit this to consume excessive CPU resources. This could slow down or crash your application, leading to degraded performance or denial of service for legitimate users.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt system availability. GDPR requires maintaining service availability, and HIPAA mandates timely access to protected health information. CPU exhaustion from this flaw could lead to service unavailability, violating these requirements.

Mitigation Strategies

Immediately update Date::Manip to version 6.99 or later, which includes the fix. Alternatively, implement input length validation before passing strings to Date::Manip functions, capping input at 256 characters. Review all Perl scripts using Date::Manip to ensure they handle untrusted input safely.

Hi! I’m here to help you understand CVE-2026-60075. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70