Executive brief
HTTP::Date is a Perl library used to process date and time information found in web headers like 'Expires' or 'Last-Modified'. A flaw in how it handles long, specially crafted date strings can cause the system to consume excessive processor power. This can lead to a denial-of-service (DoS) condition where the application becomes slow or unresponsive to legitimate users.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in HTTP::Date's parse_date() function (and str2time(), which relies on it) due to inefficient regex complexity. The parsing logic uses multiple alternative regular expressions with adjacent unbounded quantifiers followed by a trailing anchor. When processed against a long string containing a valid date prefix followed by many digits, letters, or spaces and a non-matching trailing character, the engine performs polynomial (quadratic) backtracking. An attacker can exploit this by sending a crafted HTTP header of a few dozen kilobytes, causing significant CPU exhaustion. The issue is resolved in version 6.08 by implementing a hardcoded 64-character length limit on input strings before regex processing occurs.
Affected products
- OALDERS HTTP::Date < 6.08
Timeline
- 2026-07-04: patched: Fix committed to repository
- 2026-07-17: disclosed: CVE published to NVD