Most recent entries from all

ALSA-2026:56970 — Important: perl-Date-Manip security update

Affected: AlmaLinux:9: perl-Date-Manip

Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time.

Security Fix(es):

* perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

EUVD-2026-362923

fkie_cve-2026-60075

Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.

_parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.

Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.

GHSA-6w78-p685-p2f6

Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.

Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.

OESA-2026-3539 — perl-Date-Manip security update

Affected: openEuler:20.03-LTS-SP4: perl-Date-Manip, openEuler:22.03-LTS-SP4: perl-Date-Manip, openEuler:24.03-LTS-SP1: perl-Date-Manip, openEuler:24.03-LTS-SP3: perl-Date-Manip, openEuler:24.03-LTS-SP4: perl-Date-Manip

Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times,determining a date a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time. From the very beginning, the main focus of Date::Manip has been to be able to do ANY desired date/time operation easily.Many other modules exist which may do a subset of these operations quicker or more efficiently,but no other module can do all of the operations available in Date::Manip. Date::Manip has functionality to work with several fundamental types of data. Security Fix(es):

Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check.

The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \p{Nd} and not just [0-9]. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone ($y<1 || $y>9999, $m<1 || $m>12, $d<1 || $d>$days), and _parse_check stores the numified fields ($y+0). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year…

openSUSE-SU-2026:11457-1 — perl-Date-Manip-6.990.0-2.1 on GA media

perl-Date-Manip-6.990.0-2.1 on GA media

RLSA-2026:56970 — Important: perl-Date-Manip security update

Affected: Rocky Linux:9: perl-Date-Manip

Security Fix(es):

* perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:23218-1 — Security update for perl-Date-Manip

Security update for perl-Date-Manip

UBUNTU-CVE-2026-60075

Affected: Ubuntu:14.04:LTS: libdate-manip-perl, Ubuntu:16.04:LTS: libdate-manip-perl, Ubuntu:18.04:LTS: libdate-manip-perl, Ubuntu:20.04:LTS: libdate-manip-perl, Ubuntu:22.04:LTS: libdate-manip-perl, Ubuntu:24.04:LTS: libdate-manip-perl, Ubuntu:26.04:LTS: libdate-manip-perl

Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes. Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.

WID-SEC-W-2026-2937 — Perl: Schwachstelle ermöglicht Denial of Service

Ein Angreifer kann eine Schwachstelle in Perl ausnutzen, um einen Denial of Service Angriff durchzuführen.