{"id":"CVE-2026-60075","aliases":["ALSA-2026:56970","ALSA-2026:56971","ALSA-2026:57562","AZL-94392","CLSA-2026-1788262245","CLSA-2026-1788263623","DEBIAN-CVE-2026-60075","EUVD-2026-51125","GHSA-6w78-p685-p2f6","MGASA-2026-0361","OESA-2026-3539","RHSA-2026:56970","RHSA-2026:56971","RHSA-2026:57562","RLSA-2026:56970","RLSA-2026:56971","RLSA-2026:57562","SUSE-SU-2026:23218-1","SUSE-SU-2026:23229-1","SUSE-SU-2026:3537-1","SUSE-SU-2026:3551-1","UBUNTU-CVE-2026-60075","openSUSE-SU-2026:11457-1","openSUSE-SU-2026:21510-1","openSUSE-SU-2026:21552-1"],"status":"published","title":"Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time","description":"Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.\n\n_parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.\n\nAny caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date-\u003eparse() or -\u003eparse_time() can be made to spend unbounded CPU in a single parse, a denial of service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00373,"percentile":0.31457,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2026-07-30T13:42:17Z","modified":"2026-11-10T02:50:54Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"perl-Date-Manip","fixed_in":["6.85-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"perl-Date-Manip","fixed_in":["6.94-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"perl-Date-Manip","fixed_in":["6.60-3.el8_10.1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-Date-Manip","fixed_in":["6.85-3.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"perl-Date-Manip","fixed_in":["6.85-3.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libdate-manip-perl","fixed_in":["6.99-2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-Date-Manip","fixed_in":["0:6.85-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"perl-Date-Manip","fixed_in":["0:6.94-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"perl-Date-Manip","fixed_in":["0:6.60-3.el8_10.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"perl-Date-Manip","fixed_in":["0:6.85-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"perl-Date-Manip","fixed_in":["0:6.94-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"perl-Date-Manip","fixed_in":["0:6.60-3.el8_10.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.85-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.94-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.60-3.el8_10.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.95-3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.85-3.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.85-3.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libdate-manip-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.91-1","6.92-1","6.93-1","6.94-1","6.95-1","6.96-1","6.97-1","6.98-1","6.99-1","6.99-2","7.00-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libdate-manip-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.98-1","6.99-1","6.99-2","7.00-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libdate-manip-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.99-2"}]}],"versions":["6.98-1","6.99-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.990.0-1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.990.0-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.73-3.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.88-2.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.92-2.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.92-2.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.92-2.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.85-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.94-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.60-3.el8_10.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.85-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.94-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.60-3.el8_10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.960.0-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.960.0-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.960.0-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.960.0-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.42-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.42-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.70-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.70-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.70-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.70-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.70-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.70-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.70-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.70-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.70-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.70-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.70-150000.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libdate-manip-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.40-1","6.41-1","6.42-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libdate-manip-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.50-1","6.51-1","6.52-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libdate-manip-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.59-1","6.60-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libdate-manip-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.78-1","6.79-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libdate-manip-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.85-1","6.86-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libdate-manip-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.92-1","6.93-1","6.94-1","6.95-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libdate-manip-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.98-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.990.0-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.980.0-bp160.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-Date-Manip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.960.0-160000.3.1"}]}],"bundled":2}],"references":[{"url":"https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60075-r1.patch","tags":["patch","fix","article"]},{"url":"https://metacpan.org/release/SBECK/Date-Manip-6.99/source/lib/Date/Manip/Date.pm#L1811","tags":["web","article"]},{"url":"https://metacpan.org/release/SBECK/Date-Manip-6.99/source/lib/Date/Manip/Date.pm#L1526","tags":["web","article"]},{"url":"https://github.com/SBECK-github/Date-Manip/pull/55","tags":["issue-tracking","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/30/20","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60075","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-6w78-p685-p2f6"},{"url":"https://access.redhat.com/errata/RHSA-2026:56970","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-60075","tags":["report"]},{"url":"https://bugzilla.redhat.com/2509486","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-56970.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56971","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-56971.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57562","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-57562.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1788262245.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1788263623.html","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/60xxx/CVE-2026-60075.json","tags":["advisory"]},{"url":"https://github.com/SBECK-github/Date-Manip","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-60075","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0361.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36130","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/30/19","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/30/20","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3539","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60074","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509486","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56970.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-60075","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56971.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57562.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:56970","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:56971","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:57562","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623218-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273062","tags":["report"]},{"url":"https://bugzilla.suse.com/1273063","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60075","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623229-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263537-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263551-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-60075","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/42266599/","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-60075","title":"Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time","description":"Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.\n\n_parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.\n\nAny caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date-\u003eparse() or -\u003eparse_time() can be made to spend unbounded CPU in a single parse, a denial of service.","status":"published","published":"2026-07-30T13:42:17.896Z","modified":"2026-09-02T12:23:17.858Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T13:49:09.229322Z"}],"euvd":[{"id":"EUVD-2026-51125","description":"Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.\n\n_parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.\n\nAny caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date-\u003eparse() or -\u003eparse_time() can be made to spend unbounded CPU in a single parse, a denial of service.","status":"published","published":"2026-07-30T13:42:17Z","modified":"2026-09-02T12:23:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:16.020579Z"}],"ghsa":[{"id":"GHSA-6w78-p685-p2f6","title":"Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the...","description":"Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.\n\n_parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.\n\nAny caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date-\u003eparse() or -\u003eparse_time() can be made to spend unbounded CPU in a single parse, a denial of service.","status":"published","published":"2026-07-30T15:31:51Z","modified":"2026-08-21T09:32:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:10:49.498684Z"}],"nvd":[{"id":"CVE-2026-60075","description":"Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.\n\n_parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.\n\nAny caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date-\u003eparse() or -\u003eparse_time() can be made to spend unbounded CPU in a single parse, a denial of service.","status":"published","published":"2026-07-30T14:17:02.71Z","modified":"2026-10-23T22:10:00.16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:12:33.955581Z"}],"osv":[{"id":"CVE-2026-60075","title":"Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time","description":"Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.\n\n_parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.\n\nAny caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date-\u003eparse() or -\u003eparse_time() can be made to spend unbounded CPU in a single parse, a denial of service.","status":"published","published":"2026-07-30T13:42:17.896Z","modified":"2026-10-28T02:30:20.84688308Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:45:12.933503Z"},{"id":"DEBIAN-CVE-2026-60075","description":"Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.  _parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.  Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date-\u003eparse() or -\u003eparse_time() can be made to spend unbounded CPU in a single parse, a denial of service.","status":"published","published":"2026-07-30T14:17:02.71Z","modified":"2026-10-24T09:47:36.085036889Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"OESA-2026-3539","title":"perl-Date-Manip security update","description":"Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times,determining a date a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time. From the very beginning, the main focus of Date::Manip has been to be able to do ANY desired date/time operation easily.Many other modules exist which may do a subset of these operations quicker or more efficiently,but no other module can do all of the operations available in Date::Manip. Date::Manip has functionality to work with several fundamental types of data.\r\n\r\nSecurity Fix(es):\n\nDate::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check.\n\nThe parse regexes capture year, month and day with the \\d shorthand, which on a character string matches the whole Unicode decimal digit property \\p{Nd} and not just [0-9]. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone ($y\u0026lt;1 || $y\u0026gt;9999, $m\u0026lt;1 || $m\u0026gt;12, $d\u0026lt;1 || $d\u0026gt;$days), and _parse_check stores the numified fields ($y+0). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (0?[0-9], [0-5][0-9]) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction.\n\nAny caller that passes an untrusted character string to ParseDate() or Date::Manip::Date-\u0026gt;parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.(CVE-2026-60074)\n\nDate::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.\n\n_parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.\n\nAny caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date-\u0026gt;parse() or -\u0026gt;parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.(CVE-2026-60075)","status":"published","published":"2026-08-30T04:15:31Z","modified":"2026-08-30T04:31:44.036335567Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"RHSA-2026:56970","title":"Red Hat Security Advisory: perl-Date-Manip security update","status":"published","published":"2026-08-20T10:20:00Z","modified":"2026-08-21T10:13:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:56971","title":"Red Hat Security Advisory: perl-Date-Manip security update","status":"published","published":"2026-08-20T10:20:01Z","modified":"2026-08-21T10:13:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:57562","title":"Red Hat Security Advisory: perl-Date-Manip security update","status":"published","published":"2026-08-21T10:14:00Z","modified":"2026-08-21T10:17:44.187347146Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RLSA-2026:56970","title":"Important: perl-Date-Manip security update","description":"Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time.\n\nSecurity Fix(es):\n\n* perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-20T18:04:13.440754Z","modified":"2026-08-20T18:25:50.765238716Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:56971","title":"Important: perl-Date-Manip security update","description":"Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time.\n\nSecurity Fix(es):\n\n* perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-20T18:07:20.016374Z","modified":"2026-08-20T18:25:50.758872453Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:57562","title":"Important: perl-Date-Manip security update","description":"Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time.\n\nSecurity Fix(es):\n\n* perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-21T06:01:06.770182Z","modified":"2026-08-21T06:30:04.317019562Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-60075","description":"Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes. Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date-\u003eparse() or -\u003eparse_time() can be made to spend unbounded CPU in a single parse, a denial of service.","status":"published","published":"2026-07-30T14:17:00Z","modified":"2026-11-10T02:50:54.785511461Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T03:19:41.15403Z"},{"id":"ALSA-2026:56970","title":"Important: perl-Date-Manip security update","description":"Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time.  \n\nSecurity Fix(es):  \n\n  * perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-19T00:00:00Z","modified":"2026-10-29T11:32:36.480269832Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:56971","title":"Important: perl-Date-Manip security update","description":"Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time.  \n\nSecurity Fix(es):  \n\n  * perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-19T00:00:00Z","modified":"2026-10-29T11:30:38.144813055Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:57562","title":"Important: perl-Date-Manip security update","description":"Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time.  \n\nSecurity Fix(es):  \n\n  * perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-20T00:00:00Z","modified":"2026-10-29T11:02:24.911716812Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-94392","title":"CVE-2026-60075 affecting package perl-Date-Manip 6.95-3","description":"Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.\n\n_parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.\n\nAny caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date-\u003eparse() or -\u003eparse_time() can be made to spend unbounded CPU in a single parse, a denial of service.","status":"published","published":"2026-07-30T14:17:02Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"CLSA-2026-1788262245","title":"perl-Date-Manip: Fix of CVE-2026-60075","description":"- CVE-2026-60075: reject a date or time string longer than 256 characters\n  before any parsing regex runs. The unanchored time substitution in\n  _parse_time backtracks quadratically across an interior whitespace run,\n  so a long string of spaces caused CPU exhaustion without containing any\n  time at all.\n- Drop the test suite invocation and its perl(Test::Inter) and\n  perl(Test::More) build requirements. perl-Test-Inter is not shipped in any AlmaLinux 9.2\n  repository, so the dependency could not be resolved in the 9.2 buildroot\n  and the binary build failed before the build stage. The test suite is not\n  part of the shipped package.","status":"published","published":"2026-09-01T11:40:05Z","modified":"2026-10-26T09:30:37.501371144Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788263623","title":"perl-Date-Manip: Fix of CVE-2026-60075","description":"- CVE-2026-60075: reject a date or time string longer than 256 characters\n  before any parsing regex runs. The unanchored time substitution in\n  _parse_time backtracks quadratically across an interior whitespace run,\n  so a long string of spaces caused CPU exhaustion without containing any\n  time at all.\n- Drop the test suite invocation and its perl(Test::Inter) and\n  perl(Test::More) build requirements. perl-Test-Inter is not shipped in any AlmaLinux 9.2\n  repository, so the dependency could not be resolved in the 9.2 buildroot\n  and the binary build failed before the build stage. The test suite is not\n  part of the shipped package.","status":"published","published":"2026-09-01T11:53:52Z","modified":"2026-10-26T09:31:30.959331514Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"MGASA-2026-0361","title":"Updated perl-Date-Manip packages fix security vulnerabilities","description":"Date::Manip versions through 6.99 for Perl return corrupted dates via\nnon-ASCII decimal digits that pass the numeric range tests in check\nDate::Manip versions through 6.99 for Perl allow CPU exhaustion via\nquadratic backtracking in the unanchored time substitution in\n_parse_time\n","status":"published","published":"2026-09-01T07:04:06Z","modified":"2026-09-01T07:15:07.377456094Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11457-1","title":"perl-Date-Manip-6.990.0-2.1 on GA media","description":"These are all security issues fixed in the perl-Date-Manip-6.990.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-05T00:00:00Z","modified":"2026-08-06T11:15:09.201980187Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21510-1","title":"Security update for perl-Date-Manip","description":"This update for perl-Date-Manip fixes the following issues:\n\nChanges in perl-Date-Manip:\n\n- CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check (bsc#1273063)\n- CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in _parse_time (bsc#1273062)\n","status":"published","published":"2026-07-31T12:33:33Z","modified":"2026-08-02T18:24:04.145931948Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21552-1","title":"Security update for perl-Date-Manip","description":"This update for perl-Date-Manip fixes the following issues\n\n- CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check (bsc#1273063).\n- CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in `_parse_time` (bsc#1273062).\n","status":"published","published":"2026-08-10T17:38:25Z","modified":"2026-08-12T18:23:41.795858821Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23218-1","title":"Security update for perl-Date-Manip","description":"This update for perl-Date-Manip fixes the following issues\n\n- CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check (bsc#1273063).\n- CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in `_parse_time` (bsc#1273062).\n","status":"published","published":"2026-08-10T17:37:28Z","modified":"2026-08-27T18:23:09.275614328Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23229-1","title":"Security update for perl-Date-Manip","description":"This update for perl-Date-Manip fixes the following issues\n\n- CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check (bsc#1273063).\n- CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in `_parse_time` (bsc#1273062).\n","status":"published","published":"2026-08-10T17:37:28Z","modified":"2026-08-27T18:23:10.282413984Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3537-1","title":"Security update for perl-Date-Manip","description":"This update for perl-Date-Manip fixes the following issues:\n\n- CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in\n  check (bsc#1273063).\n- CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in `_parse_time`\n  (bsc#1273062).\n","status":"published","published":"2026-08-10T10:57:21Z","modified":"2026-08-11T09:15:05.957650658Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3551-1","title":"Security update for perl-Date-Manip","description":"This update for perl-Date-Manip fixes the following issues:\n\n- CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in\n  check (bsc#1273063).\n- CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in `_parse_time`\n  (bsc#1273062).\n","status":"published","published":"2026-08-10T16:38:58Z","modified":"2026-08-12T10:45:04.520940655Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}