CPU Exhaustion Vulnerability in DateTime::Lite Product by Perl

CVE-2026-87768

What is CVE-2026-87768?

The DateTime::Lite module for Perl, prior to version 0.8.1, contains a vulnerability that permits CPU exhaustion through a per-day loop during the addition of seconds. Specifically, the function _normalize_leap_seconds iterates day by day, causing the performance bottleneck proportional to the number of seconds added. This flaw allows an attacker with control over the seconds parameter to indefinitely occupy system resources, creating a denial-of-service scenario. Both the XS implementation and its pure-Perl alternative are susceptible to this issue, posing a threat to the stability of affected systems.

References