Skip to content
Fencer Vulns
high 7.5

CVE-2026-60075 json

Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time

published 2026-07-30 3 mo ago modified 2026-10-23 16 d ago also EUVD-2026-51125

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 31%
public exploits
0
none known

Summary

Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.

_parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.

Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.

Patch / fix

  • libdate-manip-perl Debian 14 6.99-2

debian advisories DEBIAN-CVE-2026-60075

  • perl-Date-Manip RHEL 8 6.60-3.el8_10.1
  • perl-Date-Manip RHEL 10.2 6.94-5.el10_2.1
  • perl-Date-Manip RHEL 9 6.85-3.el9_8.1

red hat advisories RHSA-2026:57562RHSA-2026:56971RHSA-2026:56970

  • perl-Date-Manip SLES 16.0, SLES for SAP applications 16.0 6.960.0-160000.3.1
  • perl-Date-Manip SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 6.70-150000.4.3.1
  • perl-Date-Manip SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 6.42-3.3.1

suse advisories SUSE-SU-2026:23218-1SUSE-SU-2026:23229-1SUSE-SU-2026:3551-1SUSE-SU-2026:3537-1

  • perl-Date-Manip openSUSE Leap 16.0 6.960.0-160000.3.1
  • perl-Date-Manip openSUSE Tumbleweed 6.990.0-2.1
  • perl-Date-Manip openSUSE Leap 16.0 6.980.0-bp160.2.1

opensuse advisories openSUSE-SU-2026:21552-1openSUSE-SU-2026:11457-1openSUSE-SU-2026:21510-1

  • perl-Date-Manip AlmaLinux 8 6.60-3.el8_10.1
  • perl-Date-Manip AlmaLinux 9 6.85-3.el9_8.1
  • perl-Date-Manip AlmaLinux 10 6.94-5.el10_2.1

almalinux advisories ALSA-2026:57562ALSA-2026:56970ALSA-2026:56971

  • perl-Date-Manip Rocky Linux 8 6.60-3.el8_10.1
  • perl-Date-Manip Rocky Linux 10 6.94-5.el10_2.1
  • perl-Date-Manip Rocky Linux 9 6.85-3.el9_8.1

rocky linux advisories RLSA-2026:57562RLSA-2026:56971RLSA-2026:56970

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-60075 updated cvss 7.5

perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing

  • Red Hat Enterprise Linux 6 perl-Date-Manip
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 perl-Date-Manip
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AppStream (v. 9) perl-Date-Manip 6.85-3.el9_8.1
    fixed: vendor fix RHSA-2026:56970
  • Red Hat Enterprise Linux AppStream (v. 10) perl-Date-Manip 6.94-5.el10_2.1
    fixed: vendor fix RHSA-2026:56971
  • Red Hat Enterprise Linux BaseOS (v. 8) perl-Date-Manip 6.60-3.el8_10.1
    fixed: vendor fix RHSA-2026:57562

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.37% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Classification

Weakness
  • CWE-1333 Inefficient Regular Expression Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.