{"id":"CVE-2026-14741","aliases":["BELL-CVE-2026-14741","DEBIAN-CVE-2026-14741","EUVD-2026-45190","GHSA-mcqf-9rr5-v7rw","MGASA-2026-0362","ROOT-OS-DEBIAN-12-CVE-2026-14741","ROOT-OS-DEBIAN-13-CVE-2026-14741","SUSE-SU-2026:22859-1","SUSE-SU-2026:3334-1","SUSE-SU-2026:3454-1","UBUNTU-CVE-2026-14741","USN-8599-1","openSUSE-SU-2026:11350-1","openSUSE-SU-2026:21427-1"],"status":"published","title":"HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date","description":"HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date.\n\nparse_date() matches the date string against a chain of alternative regexes, and str2time() delegates to it. Several of these patterns place unbounded quantifiers next to each other before a trailing `\\s*$` anchor. A valid date prefix followed by a long interior run of digits, letters, or whitespace and a single trailing byte that defeats the final match forces the engine to repartition the run, giving polynomial (about quadratic) backtracking. A header value of a few tens of kilobytes runs for tens of seconds of CPU.\n\nHTTP::Date parses timestamps such as HTTP `Date`, `Expires`, and `Last-Modified` headers, which commonly originate from untrusted sources. Any caller that passes an untrusted date header to str2time() or parse_date() can be driven to consume unbounded CPU, a denial of service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.0063,"percentile":0.5047,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2026-07-10T00:00:00Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"Alpaquita:23","package":"perl-http-date","fixed_in":["6.06-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"perl-http-date","fixed_in":["6.06-r1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libhttp-date-perl","fixed_in":["6.08-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"perl-HTTP-Date","fixed_in":["6.80.0-1.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-HTTP-Date","fixed_in":["6.80.0-1.mga9"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"libhttp-date-perl","fixed_in":["6.05-2.aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-libhttp-date-perl","fixed_in":["6.05-2.aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"libhttp-date-perl","fixed_in":["6.06-1.aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-libhttp-date-perl","fixed_in":["6.06-1.aikido.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-HTTP-Date","fixed_in":["6.06-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-HTTP-Date","fixed_in":["6.06-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-HTTP-Date","fixed_in":["6.02-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl-HTTP-Date","fixed_in":["6.02-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libhttp-date-perl","fixed_in":["6.05-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libhttp-date-perl","fixed_in":["6.06-1ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libhttp-date-perl","fixed_in":["6.06-1ubuntu0.26.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-HTTP-Date","fixed_in":["6.80.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"perl-HTTP-Date","fixed_in":["6.06-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"perl-http-date","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.05-r1"},{"fixed":"6.06-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"perl-http-date","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.06-r0"},{"fixed":"6.06-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libhttp-date-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.05-2","6.06-1","6.07-1","6.08-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libhttp-date-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.06-1","6.07-1","6.08-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libhttp-date-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.08-1"}]}],"versions":["6.06-1","6.07-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-HTTP-Date","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.80.0-1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-HTTP-Date","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.80.0-1.mga9"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"libhttp-date-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.05-2.aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-libhttp-date-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.05-2.aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"libhttp-date-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.06-1.aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-libhttp-date-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.06-1.aikido.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-HTTP-Date","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.06-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-HTTP-Date","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.06-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-HTTP-Date","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.02-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl-HTTP-Date","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.02-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libhttp-date-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.02-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libhttp-date-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.02-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libhttp-date-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.02-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libhttp-date-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.02-1","6.05-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libhttp-date-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.05-1ubuntu0.1"}]}],"versions":["6.05-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libhttp-date-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.06-1ubuntu0.24.04.1"}]}],"versions":["6.05-2","6.06-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libhttp-date-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.06-1ubuntu0.26.04.1"}]}],"versions":["6.06-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libhttp-date-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.05-1ubuntu0.1"}]}],"versions":["6.05-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libhttp-date-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.06-1ubuntu0.24.04.1"}]}],"versions":["6.05-2","6.06-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libhttp-date-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.06-1ubuntu0.26.04.1"}]}],"versions":["6.06-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-HTTP-Date","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.80.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-HTTP-Date","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.06-160000.3.1"}]}]}],"products":[{"vendor":"oalders","product":"http::date"}],"references":[{"url":"https://github.com/libwww-perl/HTTP-Date/commit/78c20952cdfbf11e03cf1199ad70f13298a84c5c.patch","tags":["patch","fix"]},{"url":"https://github.com/libwww-perl/HTTP-Date/pull/33","tags":["issue-tracking","report"]},{"url":"https://metacpan.org/release/OALDERS/HTTP-Date-6.08/changes","tags":["release-notes","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/17/10","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14741","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mcqf-9rr5-v7rw"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-14741","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14741.json","tags":["advisory"]},{"url":"https://github.com/libwww-perl/HTTP-Date","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-14741","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0362.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35952","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/17/10","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622859-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271705","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14741","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263334-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263454-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-14741","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14741","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8599-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-14741","title":"HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date","description":"HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date.\n\nparse_date() matches the date string against a chain of alternative regexes, and str2time() delegates to it. Several of these patterns place unbounded quantifiers next to each other before a trailing `\\s*$` anchor. A valid date prefix followed by a long interior run of digits, letters, or whitespace and a single trailing byte that defeats the final match forces the engine to repartition the run, giving polynomial (about quadratic) backtracking. A header value of a few tens of kilobytes runs for tens of seconds of CPU.\n\nHTTP::Date parses timestamps such as HTTP `Date`, `Expires`, and `Last-Modified` headers, which commonly originate from untrusted sources. Any caller that passes an untrusted date header to str2time() or parse_date() can be driven to consume unbounded CPU, a denial of service.","status":"published","published":"2026-07-17T15:20:07.201Z","modified":"2026-08-12T18:47:08.46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T13:38:43.260938Z"}],"euvd":[{"id":"EUVD-2026-45190","description":"HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date.\n\nparse_date() matches the date string against a chain of alternative regexes, and str2time() delegates to it. Several of these patterns place unbounded quantifiers next to each other before a trailing `\\s*$` anchor. A valid date prefix followed by a long interior run of digits, letters, or whitespace and a single trailing byte that defeats the final match forces the engine to repartition the run, giving polynomial (about quadratic) backtracking. A header value of a few tens of kilobytes runs for tens of seconds of CPU.\n\nHTTP::Date parses timestamps such as HTTP `Date`, `Expires`, and `Last-Modified` headers, which commonly originate from untrusted sources. Any caller that passes an untrusted date header to str2time() or parse_date() can be driven to consume unbounded CPU, a denial of service.","status":"published","published":"2026-07-17T15:20:07Z","modified":"2026-08-12T18:47:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:57.953172Z"}],"ghsa":[{"id":"GHSA-mcqf-9rr5-v7rw","title":"HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking...","description":"HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date.\n\nparse_date() matches the date string against a chain of alternative regexes, and str2time() delegates to it. Several of these patterns place unbounded quantifiers next to each other before a trailing `\\s*$` anchor. A valid date prefix followed by a long interior run of digits, letters, or whitespace and a single trailing byte that defeats the final match forces the engine to repartition the run, giving polynomial (about quadratic) backtracking. A header value of a few tens of kilobytes runs for tens of seconds of CPU.\n\nHTTP::Date parses timestamps such as HTTP `Date`, `Expires`, and `Last-Modified` headers, which commonly originate from untrusted sources. Any caller that passes an untrusted date header to str2time() or parse_date() can be driven to consume unbounded CPU, a denial of service.","status":"published","published":"2026-07-17T18:31:24Z","modified":"2026-07-21T15:31:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:09:37.555146Z"}],"nvd":[{"id":"CVE-2026-14741","description":"HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date.\n\nparse_date() matches the date string against a chain of alternative regexes, and str2time() delegates to it. Several of these patterns place unbounded quantifiers next to each other before a trailing `\\s*$` anchor. A valid date prefix followed by a long interior run of digits, letters, or whitespace and a single trailing byte that defeats the final match forces the engine to repartition the run, giving polynomial (about quadratic) backtracking. A header value of a few tens of kilobytes runs for tens of seconds of CPU.\n\nHTTP::Date parses timestamps such as HTTP `Date`, `Expires`, and `Last-Modified` headers, which commonly originate from untrusted sources. Any caller that passes an untrusted date header to str2time() or parse_date() can be driven to consume unbounded CPU, a denial of service.","status":"published","published":"2026-07-17T16:17:13.443Z","modified":"2026-10-24T20:10:00.137Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:12:30.250437Z"}],"osv":[{"id":"CVE-2026-14741","title":"HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date","description":"HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date.\n\nparse_date() matches the date string against a chain of alternative regexes, and str2time() delegates to it. Several of these patterns place unbounded quantifiers next to each other before a trailing `\\s*$` anchor. A valid date prefix followed by a long interior run of digits, letters, or whitespace and a single trailing byte that defeats the final match forces the engine to repartition the run, giving polynomial (about quadratic) backtracking. A header value of a few tens of kilobytes runs for tens of seconds of CPU.\n\nHTTP::Date parses timestamps such as HTTP `Date`, `Expires`, and `Last-Modified` headers, which commonly originate from untrusted sources. Any caller that passes an untrusted date header to str2time() or parse_date() can be driven to consume unbounded CPU, a denial of service.","status":"published","published":"2026-07-17T15:20:07.201Z","modified":"2026-10-28T02:31:14.077445757Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:44:57.682091Z"},{"id":"DEBIAN-CVE-2026-14741","description":"HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date.  parse_date() matches the date string against a chain of alternative regexes, and str2time() delegates to it. Several of these patterns place unbounded quantifiers next to each other before a trailing `\\s*$` anchor. A valid date prefix followed by a long interior run of digits, letters, or whitespace and a single trailing byte that defeats the final match forces the engine to repartition the run, giving polynomial (about quadratic) backtracking. A header value of a few tens of kilobytes runs for tens of seconds of CPU.  HTTP::Date parses timestamps such as HTTP `Date`, `Expires`, and `Last-Modified` headers, which commonly originate from untrusted sources. Any caller that passes an untrusted date header to str2time() or parse_date() can be driven to consume unbounded CPU, a denial of service.","status":"published","published":"2026-07-17T16:17:13.443Z","modified":"2026-10-25T09:47:32.286914448Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:51.8748Z"},{"id":"UBUNTU-CVE-2026-14741","description":"HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date. parse_date() matches the date string against a chain of alternative regexes, and str2time() delegates to it. Several of these patterns place unbounded quantifiers next to each other before a trailing `\\s*$` anchor. A valid date prefix followed by a long interior run of digits, letters, or whitespace and a single trailing byte that defeats the final match forces the engine to repartition the run, giving polynomial (about quadratic) backtracking. A header value of a few tens of kilobytes runs for tens of seconds of CPU. HTTP::Date parses timestamps such as HTTP `Date`, `Expires`, and `Last-Modified` headers, which commonly originate from untrusted sources. Any caller that passes an untrusted date header to str2time() or parse_date() can be driven to consume unbounded CPU, a denial of service.","status":"published","published":"2026-07-10T00:00:00Z","modified":"2026-07-29T10:18:33.275693784Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"BELL-CVE-2026-14741","status":"published","published":"2026-07-11T12:11:50.298128Z","modified":"2026-07-12T07:15:04.499925566Z","updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"MGASA-2026-0362","title":"Updated perl-HTTP-Date packages fix a security vulnerability","description":"HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via\npolynomial regex backtracking in parse_date\n","status":"published","published":"2026-09-01T07:04:06Z","modified":"2026-09-01T07:15:04.444904169Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11350-1","title":"perl-HTTP-Date-6.80.0-1.1 on GA media","description":"These are all security issues fixed in the perl-HTTP-Date-6.80.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-23T00:00:00Z","modified":"2026-07-24T17:16:08.614474614Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21427-1","title":"Security update for perl-HTTP-Date","description":"This update for perl-HTTP-Date fixes the following issue\n\n- CVE-2026-14741: CPU exhaustion via polynomial regex backtracking in parse_date (bsc#1271705).\n","status":"published","published":"2026-07-22T19:07:44Z","modified":"2026-07-24T17:16:09.868667555Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-14741","title":"CVE-2026-14741 in libhttp-date-perl - Patched by Root","description":"Root has patched CVE-2026-14741 in the libhttp-date-perl package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-11T05:10:29Z","modified":"2026-09-11T06:15:02.684923023Z","updated_at":"2026-11-02T15:53:31.773105Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-14741","title":"CVE-2026-14741 in libhttp-date-perl - Patched by Root","description":"Root has patched CVE-2026-14741 in the libhttp-date-perl package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-09-11T05:10:05Z","modified":"2026-09-11T06:15:02.678279446Z","updated_at":"2026-11-02T15:53:33.153539Z"},{"id":"SUSE-SU-2026:22859-1","title":"Security update for perl-HTTP-Date","description":"This update for perl-HTTP-Date fixes the following issue\n\n- CVE-2026-14741: CPU exhaustion via polynomial regex backtracking in parse_date (bsc#1271705).\n","status":"published","published":"2026-07-22T18:56:27Z","modified":"2026-07-28T18:24:10.827059114Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:3334-1","title":"Security update for perl-HTTP-Date","description":"This update for perl-HTTP-Date fixes the following issue:\n\n- CVE-2026-14741: CPU exhaustion due to polynomial regex backtracking in `parse_date` when processing specially crafted\n  date strings (bsc#1271705).\n","status":"published","published":"2026-07-28T09:41:21Z","modified":"2026-07-29T18:24:24.963084209Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3454-1","title":"Security update for perl-HTTP-Date","description":"This update for perl-HTTP-Date fixes the following issue\n\n- CVE-2026-14741: CPU exhaustion due to polynomial regex backtracking in `parse_date` when processing specially crafted\n  date strings (bsc#1271705).\n","status":"published","published":"2026-08-03T11:45:33Z","modified":"2026-08-04T11:45:06.313350854Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8599-1","title":"libhttp-date-perl vulnerability","description":"It was discovered that HTTP-Date incorrectly handled parsing certain date\nstrings. An attacker could possibly use this issue to cause HTTP-Date to\nuse excessive resources, leading to a denial of service.","status":"published","published":"2026-07-23T14:30:24Z","modified":"2026-07-24T15:35:57.164098875Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}