CVE-2026-60074
Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check
Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check.
The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \p{Nd} and not just [0-9]. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone ($y<1 || $y>9999, $m<1 || $m>12, $d<1 || $d>$days), and _parse_check stores the numified fields ($y+0). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (0?[0-9], [0-5][0-9]) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction.
Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check
Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check.
The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \p{Nd} and not just [0-9]. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone ($y<1 || $y>9999, $m<1 || $m>12, $d<1 || $d>$days), and _parse_check stores the numified fields ($y+0). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (0?[0-9], [0-5][0-9]) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction.
Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.
- Record
CVE-2026-60074- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1289
- Updated
- 2026-11-02
EUVDEUVD-2026-51124
Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check.
The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \p{Nd} and not just [0-9]. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone ($y<1 || $y>9999, $m<1 || $m>12, $d<1 || $d>$days), and _parse_check stores the numified fields ($y+0). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (0?[0-9], [0-5][0-9]) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction.
Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.
- Record
EUVD-2026-51124- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hfqp-m279-7mj7
Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits...
Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check.
The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \p{Nd} and not just [0-9]. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone ($y<1 || $y>9999, $m<1 || $m>12, $d<1 || $d>$days), and _parse_check stores the numified fields ($y+0). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (0?[0-9], [0-5][0-9]) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction.
Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.
- Record
GHSA-hfqp-m279-7mj7- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1289
- Updated
- 2026-11-02
NVD
Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check.
The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \p{Nd} and not just [0-9]. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone ($y<1 || $y>9999, $m<1 || $m>12, $d<1 || $d>$days), and _parse_check stores the numified fields ($y+0). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (0?[0-9], [0-5][0-9]) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction.
Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.
- Record
CVE-2026-60074- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1289
- Updated
- 2026-11-02
OSV
Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check
Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check.
The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \p{Nd} and not just [0-9]. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone ($y<1 || $y>9999, $m<1 || $m>12, $d<1 || $d>$days), and _parse_check stores the numified fields ($y+0). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (0?[0-9], [0-5][0-9]) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction.
Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.
- Record
CVE-2026-60074- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1289
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-60074
Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \p{Nd} and not just [0-9]. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone ($y<1 || $y>9999, $m<1 || $m>12, $d<1 || $d>$days), and _parse_check stores the numified fields ($y+0). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (0?[0-9], [0-5][0-9]) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction. Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.
- Record
DEBIAN-CVE-2026-60074- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 11 moreShow less
OSVOESA-2026-3539
perl-Date-Manip security update
Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times,determining a date a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time. From the very beginning, the main focus of Date::Manip has been to be able to do ANY desired date/time operation easily.Many other modules exist which may do a subset of these operations quicker or more efficiently,but no other module can do all of the operations available in Date::Manip. Date::Manip has functionality to work with several fundamental types of data.
Security Fix(es):
Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check.
The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \p{Nd} and not just [0-9]. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone ($y<1 || $y>9999, $m<1 || $m>12, $d<1 || $d>$days), and _parse_check stores the numified fields ($y+0). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (0?[0-9], [0-5][0-9]) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction.
Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.(CVE-2026-60074)
Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.
_parse_time removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time patterns reached through a leading (?:$atrx|^|\s+). The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading \s+ consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.
Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.(CVE-2026-60075)
- Record
OESA-2026-3539- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-60074
Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \p{Nd} and not just [0-9]. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone ($y<1 || $y>9999, $m<1 || $m>12, $d<1 || $d>$days), and _parse_check stores the numified fields ($y+0). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (0?[0-9], [0-5][0-9]) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction. Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.
- Record
UBUNTU-CVE-2026-60074- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-94389 No score
CVE-2026-60074 affecting package perl-Date-Manip 6.95-3
Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check.
The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \p{Nd} and not just [0-9]. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone ($y<1 || $y>9999, $m<1 || $m>12, $d<1 || $d>$days), and _parse_check stores the numified fields ($y+0). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (0?[0-9], [0-5][0-9]) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction.
Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.
- Record
AZL-94389- Updated
- 2026-11-05
OSVMGASA-2026-0361 No score
Updated perl-Date-Manip packages fix security vulnerabilities
Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time
- Record
MGASA-2026-0361- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11457-1 No score
perl-Date-Manip-6.990.0-2.1 on GA media
These are all security issues fixed in the perl-Date-Manip-6.990.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11457-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21510-1 No score
Security update for perl-Date-Manip
This update for perl-Date-Manip fixes the following issues:
Changes in perl-Date-Manip:
- CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check (bsc#1273063)
- CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in _parse_time (bsc#1273062)
- Record
openSUSE-SU-2026:21510-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21552-1 No score
Security update for perl-Date-Manip
This update for perl-Date-Manip fixes the following issues
- CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check (bsc#1273063).
- CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in
_parse_time(bsc#1273062).
- Record
openSUSE-SU-2026:21552-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23218-1 No score
Security update for perl-Date-Manip
This update for perl-Date-Manip fixes the following issues
- CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check (bsc#1273063).
- CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in
_parse_time(bsc#1273062).
- Record
SUSE-SU-2026:23218-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23229-1 No score
Security update for perl-Date-Manip
This update for perl-Date-Manip fixes the following issues
- CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check (bsc#1273063).
- CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in
_parse_time(bsc#1273062).
- Record
SUSE-SU-2026:23229-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3537-1 No score
Security update for perl-Date-Manip
This update for perl-Date-Manip fixes the following issues:
- CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check (bsc#1273063).
- CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in
_parse_time(bsc#1273062).
- Record
SUSE-SU-2026:3537-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3551-1 No score
Security update for perl-Date-Manip
This update for perl-Date-Manip fixes the following issues:
- CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check (bsc#1273063).
- CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in
_parse_time(bsc#1273062).
- Record
SUSE-SU-2026:3551-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perl-Date-ManipAzure Linux:3 |
through 6.95-3 | None known |
libdate-manip-perlDebian:12 |
All versions, plus listed versions 6.91-16.92-16.93-16.94-16.95-1 Show 6 moreShow less6.96-16.97-16.98-16.99-16.99-27.00-1 |
None known |
libdate-manip-perlDebian:13 |
All versions, plus listed versions 6.98-16.99-16.99-27.00-1 |
None known |
libdate-manip-perlDebian:14 |
before 6.99-2, plus listed versions 6.98-16.99-1 |
6.99-2 |
perl-Date-ManipMageia:10 From an advisory covering 2 CVEs |
before 6.990.0-1.mga10 | 6.990.0-1.mga10 |
perl-Date-ManipMageia:9 From an advisory covering 2 CVEs |
before 6.990.0-1.mga9 | 6.990.0-1.mga9 |
perl-Date-ManipopenEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs |
before 6.73-3.oe2003sp4 | 6.73-3.oe2003sp4 |
perl-Date-ManipopenEuler:22.03-LTS-SP4 From an advisory covering 2 CVEs |
before 6.88-2.oe2203sp4 | 6.88-2.oe2203sp4 |
perl-Date-ManipopenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 6.92-2.oe2403sp1 | 6.92-2.oe2403sp1 |
perl-Date-ManipopenEuler:24.03-LTS-SP3 From an advisory covering 2 CVEs |
before 6.92-2.oe2403sp3 | 6.92-2.oe2403sp3 |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
perl-Date-ManipopenEuler:24.03-LTS-SP4 From an advisory covering 2 CVEs |
before 6.92-2.oe2403sp4 | 6.92-2.oe2403sp4 |
perl-Date-ManipSUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs |
before 6.960.0-160000.3.1 | 6.960.0-160000.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs |
before 6.960.0-160000.3.1 | 6.960.0-160000.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 2 CVEs |
before 6.42-3.3.1 | 6.42-3.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 2 CVEs |
before 6.42-3.3.1 | 6.42-3.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
libdate-manip-perlUbuntu:14.04:LTS |
All versions, plus listed versions 6.40-16.41-16.42-1 |
None known |
libdate-manip-perlUbuntu:16.04:LTS |
All versions, plus listed versions 6.50-16.51-16.52-1 |
None known |
libdate-manip-perlUbuntu:18.04:LTS |
All versions, plus listed versions 6.59-16.60-1 |
None known |
libdate-manip-perlUbuntu:20.04:LTS |
All versions, plus listed versions 6.78-16.79-1 |
None known |
libdate-manip-perlUbuntu:22.04:LTS |
All versions, plus listed versions 6.85-16.86-1 |
None known |
libdate-manip-perlUbuntu:24.04:LTS |
All versions, plus listed versions 6.92-16.93-16.94-16.95-1 |
None known |
libdate-manip-perlUbuntu:26.04:LTS |
All versions, plus listed versions 6.98-1 |
None known |
perl-Date-ManipopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 6.990.0-2.1 | 6.990.0-2.1 |
perl-Date-ManipopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 6.980.0-bp160.2.1 | 6.980.0-bp160.2.1 |
perl-Date-ManipopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 6.960.0-160000.3.1 | 6.960.0-160000.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-60074 is a high vulnerability (CVSS 7.5) in perl-Date-Manip, published July 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in libdate-manip-perl 6.99-2.
References
security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60074-r1.patch
metacpan.org/release/SBECK/Date-Manip-6.99/source/lib/Date/Manip/Base.pm
github.com/SBECK-github/Date-Manip/pull/54
openwall.com/lists/oss-security/2026/07/30/19
nvd.nist.gov/vuln/detail/CVE-2026-60074
Show 21 moreShow less
cpan.org/modules
security-tracker.debian.org/tracker/CVE-2026-60074
advisories.mageia.org/MGASA-2026-0361.html
bugs.mageia.org/show_bug.cgi?id=36130
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-3539
suse.com/support/update/announcement/2026/suse-su-202623218-1
bugzilla.suse.com/1273062
ubuntu.com/security/CVE-2026-60074
cve.org/CVERecord?id=CVE-2026-60074
lists.security.metacpan.org/cve-announce/msg/42266594