Executive brief
The Date::Manip library, a popular Perl tool for date and time manipulation, is vulnerable to a denial-of-service attack. An attacker can provide a specially crafted string containing long sequences of whitespace to exhaust the server's processor resources. This can cause applications using the library to become unresponsive, potentially impacting service availability and business operations.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Date::Manip through version 6.99. The internal `_parse_time` function uses an unanchored substitution regex to remove time patterns from input strings. Due to the way the regex handles leading whitespace and alternations, it triggers quadratic backtracking when processing long runs of whitespace. An attacker can exploit this by passing a large string of whitespace to public methods like `ParseDate()`, `parse()`, or `parse_time()`, causing the Perl interpreter to consume excessive CPU cycles. A patch is available via CPANSec.
Affected products
- SBECK Date::Manip through 6.99
Timeline
- 2026-07-30: advisory: CVE-2026-60075 published by CPANSec/NVD