CVE-2026-14741

Name of the Vulnerable Software and Affected Versions HTTP::Date versions prior to 6.08

Description An issue exists where the parse date() function, which is also used by str2time(), is susceptible to Regular Expression Denial of Service (ReDoS). This occurs because several regex patterns use unbounded quantifiers adjacent to each other before a trailing s*$ anchor. When a valid date prefix is followed by a long sequence of digits, letters, or whitespace and a final byte that prevents a match, the engine performs polynomial backtracking. This can lead to CPU exhaustion and a denial of service when processing untrusted HTTP headers such as Date, Expires, and Last-Modified.

Recommendations Update HTTP::Date to version 6.08 or later. As a temporary mitigation, restrict the use of the parse date() and str2time() functions when processing untrusted date headers.