HTTP::Date versions before 6.08 contain a regex-driven parse_date function that uses a chain of patterns with unbounded quantifiers placed in sequence. When an attacker sends a date header with an excessively long run of digits, letters, or whitespace followed by a single trailing byte, the Perl regex engine must perform polynomial backtracking, consuming significant CPU time. This regular-expression backtracking flaw (CWE-1333) can cause the process that parses the header to stall for tens of seconds, leading to a denial of service.

The vulnerability affects any installation of the OALDERS HTTP::Date Perl module with a version lower than 6.08. The module is commonly used to parse the Date, Expires, and Last-Modified HTTP headers, which are typically supplied by external clients. Any application or service that calls str2time or parse_date on untrusted header values is susceptible.

The CVSS score is 7.5, indicating a high impact, but the EPSS score is below 1 %, and the flaw is not listed in the CISA KEV catalog. An attacker can trigger the denial of service by crafting a malicious HTTP request containing a long, problematic date header, which can be sent from the internet to the target server. Thus the attack vector is remote network access, requires no privileged interaction, and can affect a single user session or an entire application if the server is busy. While the probability of exploitation is low, the potential service disruption warrants immediate mitigation.