CVE-2026-60075

Name of the Vulnerable Software and Affected Versions Date::Manip versions prior to 7.0

Description CPU exhaustion can occur due to quadratic backtracking during unanchored time substitution within the parse time() function. The issue arises when the function uses an unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time patterns. When processing a long sequence of whitespace, the regular expression engine greedily consumes the whitespace and then backtracks repeatedly, leading to a significant increase in CPU usage. This can result in a denial of service if an untrusted string of unbounded length is passed to ParseDate(), Date::Manip::Date->parse(), or Date::Manip::Date->parse time().

Recommendations Update to a version newer than 6.99. As a temporary mitigation, restrict the length of untrusted strings passed to ParseDate(), Date::Manip::Date->parse(), and Date::Manip::Date->parse time().