CVE-2026-60074

Name of the Vulnerable Software and Affected Versions Date::Manip versions prior to 7.0

Description Processing of untrusted character strings in ParseDate() or Date::Manip::Date->parse() can result in corrupted dates without triggering a parse error. This occurs because the parsing regular expressions use the d shorthand, which matches the Unicode decimal digit property p{Nd} instead of only ASCII digits [0-9]. When the Date::Manip::Base::check function validates these fields using numeric comparisons, Perl truncates strings at the first non-ASCII digit. Consequently, a field starting with ASCII digits followed by a non-ASCII digit may be numified to an in-range prefix, causing the resulting date to differ from the input string. This behavior can bypass logic dependent on parsed dates, such as expiry checks or retention windows.

Recommendations Update Date::Manip to version 7.0 or later.