The vulnerability in HTTP::Date (CVE-2026-14741) arises from inefficient regular expression complexity in the parse_date function. Several regex patterns used to match date strings contain unbounded quantifiers adjacent to each other before a trailing whitespace anchor, causing polynomial (approximately quadratic) backtracking. When a valid date prefix is followed by a long run of digits, letters, or whitespace and a single trailing byte that prevents a match, the regex engine performs extensive repartitioning of the input, resulting in excessive CPU consumption. This can be exploited by passing a maliciously crafted date header to str2time() or parse_date(), causing a denial of service via CPU exhaustion.

An attacker can cause a denial of service by supplying a specially crafted HTTP date header that triggers excessive CPU usage during regex parsing. This affects any caller using str2time() or parse_date() on untrusted input, potentially leading to service disruption due to CPU exhaustion. There is no impact on confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing untrusted or excessively large date header values to str2time() or parse_date(). Consider implementing input validation or rate limiting to mitigate potential denial of service.