Skip to content
Fencer Vulns
high 7.5

CVE-2026-60074 json

Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check

published 2026-07-30 3 mo ago modified 2026-10-23 16 d ago also EUVD-2026-51124

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check.

The parse regexes capture year, month and day with the `\d` shorthand, which on a character string matches the whole Unicode decimal digit property `\p{Nd}` and not just `[0-9]`. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone (`$y<1 || $y>9999`, `$m<1 || $m>12`, `$d<1 || $d>$days`), and _parse_check stores the numified fields (`$y+0`). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (`0?[0-9]`, `[0-5][0-9]`) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction.

Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.

Patch / fix

  • libdate-manip-perl Debian 14 6.99-2

debian advisories DEBIAN-CVE-2026-60074

  • perl-Date-Manip SLES 16.0, SLES for SAP applications 16.0 6.960.0-160000.3.1
  • perl-Date-Manip SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 6.70-150000.4.3.1
  • perl-Date-Manip SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 6.42-3.3.1

suse advisories SUSE-SU-2026:23218-1SUSE-SU-2026:23229-1SUSE-SU-2026:3551-1SUSE-SU-2026:3537-1

  • perl-Date-Manip openSUSE Leap 16.0 6.960.0-160000.3.1
  • perl-Date-Manip openSUSE Tumbleweed 6.990.0-2.1
  • perl-Date-Manip openSUSE Leap 16.0 6.980.0-bp160.2.1

opensuse advisories openSUSE-SU-2026:21552-1openSUSE-SU-2026:11457-1openSUSE-SU-2026:21510-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-60074 updated cvss 4.3

Date-Manip: Date::Manip: Incorrect date parsing leads to logic errors

  • Red Hat Enterprise Linux 6 perl-Date-Manip Red Hat Enterprise Linux 7 perl-Date-Manip Red Hat Enterprise Linux 8 perl-Date-Manip Red Hat Enterprise Linux 9 perl-Date-Manip Red Hat Enterprise Linux 10 perl-Date-Manip
    affected: workaround, no fix available “Ensure that date input passed to Date::Manip parsing functions is validated to contain only ASCII digits (0-9) before processing.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Classification

Weakness
  • CWE-1289 Improper Validation of Unsafe Equivalence in Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.