Denial of Service Vulnerability in Date::Manip Perl Library

CVE-2026-60075

What is CVE-2026-60075?

The Date::Manip Perl library is susceptible to a Denial of Service (DoS) attack that can lead to CPU exhaustion through the improper handling of unanchored time substitutions during the parsing of time strings. Specifically, the _parse_time function allows attackers to input strings with excessive whitespace, triggering quadratic backtracking. This results in unbounded CPU usage as the library struggles to process long runs of whitespace, significantly increasing processing time with larger inputs. As a consequence, malicious actors can exploit this vulnerability to hinder the normal functioning of applications that rely on Date::Manip by submitting crafted inputs to functions like ParseDate(), Date::Manip::Date->parse(), or ->parse_time(). Developers should ensure that untrusted inputs are carefully validated to mitigate the risk of potential abuse.

References