Description
Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.

_parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.

Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.
Published: 2026-07-30
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Date::Manip versions through 7.00 contain a CPU exhaustion flaw caused by quadratic backtracking in the unanchored time substitution within the internal _parse_time routine. The flaw, which falls under CWE-1333 (Regression of CPU Complexity), allows an attacker to supply an untrusted string with an arbitrarily long run of whitespace. The parser attempts to match time patterns at every position in the whitespace, resulting in quadratic increase in processing time; hundreds of kilobytes of space can force minutes of CPU usage for a single parse call.

Affected Systems

The vulnerable product is Date::Manip for Perl, with all releases through version 7.00. The community patch addresses version 6.99, but all earlier releases are also affected.

Risk and Exploitability

The CVSS score is 7.5, and the EPSS score is < 1%; the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the denial of service simply by feeding the parser a long untrusted input string that contains a continuous block of whitespace. The flaw does not require any other secret or privileged capability. Because the exploit relies on CPU consumption alone, automated or manual denial‑of‑service attacks are feasible, especially in environments where the Date::Manip library is exposed to external or untrusted data such as web or network services.

Generated by OpenCVE AI on September 2, 2026 at 13:43 UTC.

Remediation

Vendor Workaround

No fixed release is available. Apply the patch, which rejects a string longer than 256 characters at the parse entries, or cap the length of untrusted input before parsing it; legitimate date strings are well under 100 characters.

OpenCVE Recommended Actions

  • Apply the documented community patch, which rejects input strings longer than 256 characters in the parse entries.
  • If a patch is unavailable, limit the length of untrusted strings to 256 characters before calling ParseDate(), parse(), or parse_time().
  • Sanitize input so that any run of whitespace is reduced to a maximum of a few characters or removed entirely prior to parsing.

Generated by OpenCVE AI on September 2, 2026 at 13:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Description Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes. Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service. Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes. Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.
Title Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time

Fri, 21 Aug 2026 08:30:00 +0000

Type Values Removed Values Added
References

Fri, 14 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 31 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Sbeck
Sbeck date::manip
Vendors & Products Sbeck
Sbeck date::manip

Thu, 30 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
Description Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes. Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.
Title Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time
Weaknesses CWE-1333
References

Subscriptions

Sbeck Date::manip
cve-icon MITRE

Status: PUBLISHED

Assigner: CPANSec

Published:

Updated: 2026-09-02T12:23:17.858Z

Reserved: 2026-07-08T10:28:02.310Z

Link: CVE-2026-60075

cve-icon Vulnrichment

Updated: 2026-07-30T16:31:42.201Z

cve-icon NVD

Status : Deferred

Published: 2026-07-30T14:17:02.710

Modified: 2026-09-02T13:18:03.950

Link: CVE-2026-60075

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-30T13:42:17Z

Links: CVE-2026-60075 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T13:45:17Z

Weaknesses
  • CWE-1333

    Inefficient Regular Expression Complexity