Date Manipulation Flaw in Perl Affects SBECK's Date::Manip

CVE-2026-60074

What is CVE-2026-60074?

A flaw in Date::Manip affects how it handles date parsing, allowing for corrupted dates to be returned when non-ASCII decimal digits are included. The library captures date fields using regex patterns that match the entire Unicode decimal digit set rather than restricting this to standard ASCII digits. This can result in a user-provided date string being misinterpreted, allowing an attacker to manipulate date logic without generating any parse errors. Fields may be shifted silently, for instance, when using a year with ASCII digits followed by a non-ASCII digit, causing checks like expiry dates to fail without notice. This vulnerability can have serious implications for systems relying on accurate date manipulation for their operations.

References