CVE-2026-60075: CWE-1333 Inefficient Regular Expression Complexity
Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes. Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.
AI Analysis
Technical Summary
CVE-2026-60075 describes a denial of service vulnerability in Date::Manip versions through 6.99 for Perl. The vulnerability is due to inefficient regular expression complexity (CWE-1333) in the _parse_time function, which uses an unanchored substitution regex to remove time patterns from strings. The regex engine performs quadratic backtracking when processing long runs of whitespace, causing CPU exhaustion. Any caller passing untrusted, arbitrarily long strings containing whitespace to ParseDate(), Date::Manip::Date->parse(), or ->parse_time() can trigger this excessive CPU usage, resulting in denial of service.
Potential Impact
The vulnerability allows an attacker to cause a denial of service by forcing the affected software to consume excessive CPU resources during parsing. This occurs without requiring the presence of actual time data in the input, only long runs of whitespace. The impact is limited to availability degradation due to CPU exhaustion; confidentiality and integrity are not affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing untrusted input with long whitespace runs to the affected Date::Manip parsing functions. Consider input validation or limiting input length as temporary mitigations.
CVE-2026-60075: CWE-1333 Inefficient Regular Expression Complexity
Description
Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes. Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-60075 describes a denial of service vulnerability in Date::Manip versions through 6.99 for Perl. The vulnerability is due to inefficient regular expression complexity (CWE-1333) in the _parse_time function, which uses an unanchored substitution regex to remove time patterns from strings. The regex engine performs quadratic backtracking when processing long runs of whitespace, causing CPU exhaustion. Any caller passing untrusted, arbitrarily long strings containing whitespace to ParseDate(), Date::Manip::Date->parse(), or ->parse_time() can trigger this excessive CPU usage, resulting in denial of service.
Potential Impact
The vulnerability allows an attacker to cause a denial of service by forcing the affected software to consume excessive CPU resources during parsing. This occurs without requiring the presence of actual time data in the input, only long runs of whitespace. The impact is limited to availability degradation due to CPU exhaustion; confidentiality and integrity are not affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing untrusted input with long whitespace runs to the affected Date::Manip parsing functions. Consider input validation or limiting input length as temporary mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-07-08T10:28:02.310Z
- State
- PUBLISHED
Threat ID: 6a6b5ad09c2644c7f82c544b
Added to database: 07/30/2026, 14:08:16 UTC
Last enriched: 08/06/2026, 16:39:19 UTC
Last updated: 09/12/2026, 10:01:32 UTC
Views: 74
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.