CVE-2026-60075 describes a vulnerability in Date::Manip versions through 6.99 where the _parse_time function uses an unanchored substitution with a complex regular expression that leads to quadratic backtracking. The pattern attempts to match time expressions preceded by whitespace or string start, but when given a long run of whitespace without digits, the regex engine backtracks extensively, causing CPU usage to increase quadratically with whitespace length. This results in a denial of service via CPU exhaustion when parsing untrusted input strings of unbounded length.

The vulnerability allows an attacker to cause a denial of service by forcing the Date::Manip parser to consume excessive CPU resources. This occurs even if no actual time data is present, as long runs of whitespace trigger the inefficient regex backtracking. The impact is unbounded CPU consumption leading to potential service disruption or degradation in any application using affected versions of Date::Manip to parse untrusted input.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing untrusted or unbounded-length strings containing long whitespace runs to ParseDate(), Date::Manip::Date->parse(), or ->parse_time(). Consider input validation or limiting input size to mitigate the risk of CPU exhaustion.