Date::Manip versions through 6.99 for Perl use regexes that match Unicode decimal digits (\p{Nd}) instead of strictly ASCII digits ([0-9]) when parsing year, month, and day fields. The numeric validation checks only numeric ranges after Perl numifies the strings, which truncates at the first non-ASCII digit. This allows crafted inputs with non-ASCII decimal digits to pass validation but produce corrupted dates. Time fields are not affected due to explicit ASCII digit matching. The flaw can cause callers passing untrusted strings to ParseDate() or Date::Manip::Date->parse() to receive dates that differ from the input without parse errors, potentially bypassing date-based logic.

An attacker or malformed input can cause Date::Manip to return incorrect date values without triggering parse errors. This silent corruption can affect any logic relying on accurate date parsing, such as expiry checks or retention windows, potentially leading to incorrect application behavior or security bypasses. There is no direct confidentiality or integrity impact stated, but availability impact is high due to possible logic failures.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing untrusted input containing non-ASCII decimal digits to Date::Manip parsing functions or implement input validation to restrict date strings to ASCII digits only.