CVE-2026-60075
Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time
Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.
_parse_time removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time patterns reached through a leading (?:$atrx|^|\s+). The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading \s+ consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.
Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time
Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.
_parse_time removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time patterns reached through a leading (?:$atrx|^|\s+). The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading \s+ consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.
Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.
- Record
CVE-2026-60075- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
EUVDEUVD-2026-51125
Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.
_parse_time removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time patterns reached through a leading (?:$atrx|^|\s+). The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading \s+ consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.
Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.
- Record
EUVD-2026-51125- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6w78-p685-p2f6
Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the...
Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.
_parse_time removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time patterns reached through a leading (?:$atrx|^|\s+). The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading \s+ consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.
Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.
- Record
GHSA-6w78-p685-p2f6- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
NVD
Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.
_parse_time removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time patterns reached through a leading (?:$atrx|^|\s+). The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading \s+ consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.
Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.
- Record
CVE-2026-60075- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSV
Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time
Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.
_parse_time removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time patterns reached through a leading (?:$atrx|^|\s+). The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading \s+ consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.
Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.
- Record
CVE-2026-60075- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-60075
Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time patterns reached through a leading (?:$atrx|^|\s+). The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading \s+ consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes. Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.
- Record
DEBIAN-CVE-2026-60075- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 22 moreShow less
OSVOESA-2026-3539
perl-Date-Manip security update
Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times,determining a date a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time. From the very beginning, the main focus of Date::Manip has been to be able to do ANY desired date/time operation easily.Many other modules exist which may do a subset of these operations quicker or more efficiently,but no other module can do all of the operations available in Date::Manip. Date::Manip has functionality to work with several fundamental types of data.
Security Fix(es):
Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check.
The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \p{Nd} and not just [0-9]. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone ($y<1 || $y>9999, $m<1 || $m>12, $d<1 || $d>$days), and _parse_check stores the numified fields ($y+0). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (0?[0-9], [0-5][0-9]) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction.
Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.(CVE-2026-60074)
Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.
_parse_time removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time patterns reached through a leading (?:$atrx|^|\s+). The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading \s+ consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.
Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.(CVE-2026-60075)
- Record
OESA-2026-3539- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:56970
Red Hat Security Advisory: perl-Date-Manip security update
- Record
RHSA-2026:56970- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:56971
Red Hat Security Advisory: perl-Date-Manip security update
- Record
RHSA-2026:56971- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:57562
Red Hat Security Advisory: perl-Date-Manip security update
- Record
RHSA-2026:57562- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2026:56970
Important: perl-Date-Manip security update
Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time.
Security Fix(es):
- perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:56970- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2026:56971
Important: perl-Date-Manip security update
Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time.
Security Fix(es):
- perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:56971- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2026:57562
Important: perl-Date-Manip security update
Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time.
Security Fix(es):
- perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:57562- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-60075
Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time patterns reached through a leading (?:$atrx|^|\s+). The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading \s+ consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes. Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.
- Record
UBUNTU-CVE-2026-60075- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2026:56970 No score
Important: perl-Date-Manip security update
Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time.
Security Fix(es):
- perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:56970- Updated
- 2026-11-02
OSVALSA-2026:56971 No score
Important: perl-Date-Manip security update
Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time.
Security Fix(es):
- perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:56971- Updated
- 2026-11-02
OSVALSA-2026:57562 No score
Important: perl-Date-Manip security update
Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time.
Security Fix(es):
- perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:57562- Updated
- 2026-11-02
OSVAZL-94392 No score
CVE-2026-60075 affecting package perl-Date-Manip 6.95-3
Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.
_parse_time removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time patterns reached through a leading (?:$atrx|^|\s+). The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading \s+ consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.
Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.
- Record
AZL-94392- Updated
- 2026-11-05
OSVCLSA-2026-1788262245 No score
perl-Date-Manip: Fix of CVE-2026-60075
- CVE-2026-60075: reject a date or time string longer than 256 characters before any parsing regex runs. The unanchored time substitution in _parse_time backtracks quadratically across an interior whitespace run, so a long string of spaces caused CPU exhaustion without containing any time at all.
- Drop the test suite invocation and its perl(Test::Inter) and perl(Test::More) build requirements. perl-Test-Inter is not shipped in any AlmaLinux 9.2 repository, so the dependency could not be resolved in the 9.2 buildroot and the binary build failed before the build stage. The test suite is not part of the shipped package.
- Record
CLSA-2026-1788262245- Updated
- 2026-11-02
OSVCLSA-2026-1788263623 No score
perl-Date-Manip: Fix of CVE-2026-60075
- CVE-2026-60075: reject a date or time string longer than 256 characters before any parsing regex runs. The unanchored time substitution in _parse_time backtracks quadratically across an interior whitespace run, so a long string of spaces caused CPU exhaustion without containing any time at all.
- Drop the test suite invocation and its perl(Test::Inter) and perl(Test::More) build requirements. perl-Test-Inter is not shipped in any AlmaLinux 9.2 repository, so the dependency could not be resolved in the 9.2 buildroot and the binary build failed before the build stage. The test suite is not part of the shipped package.
- Record
CLSA-2026-1788263623- Updated
- 2026-11-02
OSVMGASA-2026-0361 No score
Updated perl-Date-Manip packages fix security vulnerabilities
Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time
- Record
MGASA-2026-0361- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11457-1 No score
perl-Date-Manip-6.990.0-2.1 on GA media
These are all security issues fixed in the perl-Date-Manip-6.990.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11457-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21510-1 No score
Security update for perl-Date-Manip
This update for perl-Date-Manip fixes the following issues:
Changes in perl-Date-Manip:
- CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check (bsc#1273063)
- CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in _parse_time (bsc#1273062)
- Record
openSUSE-SU-2026:21510-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21552-1 No score
Security update for perl-Date-Manip
This update for perl-Date-Manip fixes the following issues
- CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check (bsc#1273063).
- CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in
_parse_time(bsc#1273062).
- Record
openSUSE-SU-2026:21552-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23218-1 No score
Security update for perl-Date-Manip
This update for perl-Date-Manip fixes the following issues
- CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check (bsc#1273063).
- CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in
_parse_time(bsc#1273062).
- Record
SUSE-SU-2026:23218-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23229-1 No score
Security update for perl-Date-Manip
This update for perl-Date-Manip fixes the following issues
- CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check (bsc#1273063).
- CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in
_parse_time(bsc#1273062).
- Record
SUSE-SU-2026:23229-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3537-1 No score
Security update for perl-Date-Manip
This update for perl-Date-Manip fixes the following issues:
- CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check (bsc#1273063).
- CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in
_parse_time(bsc#1273062).
- Record
SUSE-SU-2026:3537-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3551-1 No score
Security update for perl-Date-Manip
This update for perl-Date-Manip fixes the following issues:
- CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check (bsc#1273063).
- CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in
_parse_time(bsc#1273062).
- Record
SUSE-SU-2026:3551-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perl-Date-ManipAlmaLinux:9 |
before 6.85-3.el9_8.1 | 6.85-3.el9_8.1 |
perl-Date-ManipAlmaLinux:10 |
before 6.94-5.el10_2.1 | 6.94-5.el10_2.1 |
perl-Date-ManipAlmaLinux:8 |
before 6.60-3.el8_10.1 | 6.60-3.el8_10.1 |
perl-Date-ManipAzure Linux:3 |
through 6.95-3 | None known |
perl-Date-ManipTuxCare:AlmaLinux:9.2 |
before 6.85-3.el9_2.tuxcare.els1 | 6.85-3.el9_2.tuxcare.els1 |
perl-Date-ManipTuxCare:AlmaLinux:9.6 |
before 6.85-3.el9_6.tuxcare.els1 | 6.85-3.el9_6.tuxcare.els1 |
libdate-manip-perlDebian:12 |
All versions, plus listed versions 6.91-16.92-16.93-16.94-16.95-1 Show 6 moreShow less6.96-16.97-16.98-16.99-16.99-27.00-1 |
None known |
libdate-manip-perlDebian:13 |
All versions, plus listed versions 6.98-16.99-16.99-27.00-1 |
None known |
libdate-manip-perlDebian:14 |
before 6.99-2, plus listed versions 6.98-16.99-1 |
6.99-2 |
perl-Date-ManipMageia:10 From an advisory covering 2 CVEs |
before 6.990.0-1.mga10 | 6.990.0-1.mga10 |
Show 37 moreShow less
| Package | Affected | Fixed |
|---|---|---|
perl-Date-ManipMageia:9 From an advisory covering 2 CVEs |
before 6.990.0-1.mga9 | 6.990.0-1.mga9 |
perl-Date-ManipopenEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs |
before 6.73-3.oe2003sp4 | 6.73-3.oe2003sp4 |
perl-Date-ManipopenEuler:22.03-LTS-SP4 From an advisory covering 2 CVEs |
before 6.88-2.oe2203sp4 | 6.88-2.oe2203sp4 |
perl-Date-ManipopenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 6.92-2.oe2403sp1 | 6.92-2.oe2403sp1 |
perl-Date-ManipopenEuler:24.03-LTS-SP3 From an advisory covering 2 CVEs |
before 6.92-2.oe2403sp3 | 6.92-2.oe2403sp3 |
perl-Date-ManipopenEuler:24.03-LTS-SP4 From an advisory covering 2 CVEs |
before 6.92-2.oe2403sp4 | 6.92-2.oe2403sp4 |
perl-Date-ManipRed Hat:enterprise_linux:9::appstream |
before 0:6.85-3.el9_8.1 | 0:6.85-3.el9_8.1 |
perl-Date-ManipRed Hat:enterprise_linux:10.2 |
before 0:6.94-5.el10_2.1 | 0:6.94-5.el10_2.1 |
perl-Date-ManipRed Hat:enterprise_linux:8::baseos |
before 0:6.60-3.el8_10.1 | 0:6.60-3.el8_10.1 |
perl-Date-ManipRocky Linux:9 |
before 0:6.85-3.el9_8.1 | 0:6.85-3.el9_8.1 |
perl-Date-ManipRocky Linux:10 |
before 0:6.94-5.el10_2.1 | 0:6.94-5.el10_2.1 |
perl-Date-ManipRocky Linux:8 |
before 0:6.60-3.el8_10.1 | 0:6.60-3.el8_10.1 |
perl-Date-ManipSUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs |
before 6.960.0-160000.3.1 | 6.960.0-160000.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs |
before 6.960.0-160000.3.1 | 6.960.0-160000.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 2 CVEs |
before 6.42-3.3.1 | 6.42-3.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 2 CVEs |
before 6.42-3.3.1 | 6.42-3.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
perl-Date-ManipSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 2 CVEs |
before 6.70-150000.4.3.1 | 6.70-150000.4.3.1 |
libdate-manip-perlUbuntu:14.04:LTS |
All versions, plus listed versions 6.40-16.41-16.42-1 |
None known |
libdate-manip-perlUbuntu:16.04:LTS |
All versions, plus listed versions 6.50-16.51-16.52-1 |
None known |
libdate-manip-perlUbuntu:18.04:LTS |
All versions, plus listed versions 6.59-16.60-1 |
None known |
libdate-manip-perlUbuntu:20.04:LTS |
All versions, plus listed versions 6.78-16.79-1 |
None known |
libdate-manip-perlUbuntu:22.04:LTS |
All versions, plus listed versions 6.85-16.86-1 |
None known |
libdate-manip-perlUbuntu:24.04:LTS |
All versions, plus listed versions 6.92-16.93-16.94-16.95-1 |
None known |
libdate-manip-perlUbuntu:26.04:LTS |
All versions, plus listed versions 6.98-1 |
None known |
perl-Date-ManipopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 6.990.0-2.1 | 6.990.0-2.1 |
perl-Date-ManipopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 6.980.0-bp160.2.1 | 6.980.0-bp160.2.1 |
perl-Date-ManipopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 6.960.0-160000.3.1 | 6.960.0-160000.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-60075 is a high vulnerability (CVSS 7.5) in perl-Date-Manip, published July 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in perl-Date-Manip 6.85-3.el9_8.1.
References
security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60075-r1.patch
metacpan.org/release/SBECK/Date-Manip-6.99/source/lib/Date/Manip/Date.pm
github.com/SBECK-github/Date-Manip/pull/55
openwall.com/lists/oss-security/2026/07/30/20
nvd.nist.gov/vuln/detail/CVE-2026-60075
Show 38 moreShow less
access.redhat.com/errata/RHSA-2026:56970
bugzilla.redhat.com/2509486
errata.almalinux.org/9/ALSA-2026-56970.html
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1788262245.html
cpan.org/modules
security-tracker.debian.org/tracker/CVE-2026-60075
advisories.mageia.org/MGASA-2026-0361.html
bugs.mageia.org/show_bug.cgi?id=36130
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-3539
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56970.json
cve.org/CVERecord?id=CVE-2026-60075
errata.rockylinux.org/RLSA-2026:56970
suse.com/support/update/announcement/2026/suse-su-202623218-1
bugzilla.suse.com/1273062
ubuntu.com/security/CVE-2026-60075
lists.security.metacpan.org/cve-announce/msg/42266599