Description
Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.

_parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.

Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.
Published: 2026-07-30
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Date::Manip versions up to 6.99 contain a CPU exhaustion flaw caused by quadratic backtracking in the unanchored time substitution within the internal _parse_time routine. The flaw, which falls under CWE-1333 (Regression of CPU Complexity), allows an attacker to supply an untrusted string with an arbitrarily long run of whitespace. The parser attempts to match time patterns at every position in the whitespace, resulting in exponential increase in processing time; hundreds of kilobytes of space can force minutes of CPU usage for a single parse call.

Affected Systems

The affected product is SBECK Date::Manip for Perl, versions 6.99 and all earlier releases. No specific sub‑version ranges beyond this upper bound are listed; therefore all products up to 6.99 are considered vulnerable.

Risk and Exploitability

The CVSS score is 7.5, and the EPSS score is < 1%; the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the denial of service simply by feeding the parser a long untrusted input string that contains a continuous block of whitespace. The flaw does not require any other secret or privileged capability. Because the exploit relies on CPU consumption alone, automated or manual denial‑of‑service attacks are feasible, especially in environments where the Date::Manip library is exposed to external or untrusted data such as web or network services.

Generated by OpenCVE AI on August 2, 2026 at 05:23 UTC.

Remediation

Vendor Workaround

No fixed release is available. Apply the patch, which rejects a string longer than 256 characters at the parse entries, or cap the length of untrusted input before parsing it; legitimate date strings are well under 100 characters.

OpenCVE Recommended Actions

  • Apply the documented community patch, which rejects input strings longer than 256 characters in the parse entries.
  • If a patch is unavailable, limit the length of untrusted strings to 256 characters before calling ParseDate(), parse(), or parse_time().
  • Sanitize input so that any run of whitespace is reduced to a maximum of a few characters or removed entirely prior to parsing.

Generated by OpenCVE AI on August 2, 2026 at 05:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 31 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Sbeck
Sbeck date::manip
Vendors & Products Sbeck
Sbeck date::manip

Thu, 30 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
Description Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes. Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.
Title Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time
Weaknesses CWE-1333
References

Subscriptions

Sbeck Date::manip
cve-icon MITRE

Status: PUBLISHED

Assigner: CPANSec

Published:

Updated: 2026-07-31T17:56:04.469Z

Reserved: 2026-07-08T10:28:02.310Z

Link: CVE-2026-60075

cve-icon Vulnrichment

Updated: 2026-07-30T16:31:42.201Z

cve-icon NVD

Status : Deferred

Published: 2026-07-30T14:17:02.710

Modified: 2026-07-31T18:17:18.980

Link: CVE-2026-60075

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-30T13:42:17Z

Links: CVE-2026-60075 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T05:30:06Z

Weaknesses
  • CWE-1333

    Inefficient Regular Expression Complexity