Threat Intelligence Database

Date::Manip versions up to 6.99 for Perl contain an inefficient regular expression in the _parse_time function that can cause CPU exhaustion. The vulnerability arises from quadratic backtracking when parsing unanchored time substitutions in strings with long runs of whitespace. This can lead to denial of service by causing excessive CPU usage during parsing. Any untrusted input with large whitespace sequences passed to ParseDate(), Date::Manip::Date->parse(), or ->parse_time() can trigger this condition.

Date::Manip versions up to 6.99 for Perl have a vulnerability where non-ASCII decimal digits in date input fields can cause corrupted date outputs without parse errors. This occurs because the parsing regex accepts any Unicode decimal digit, but numeric validation truncates at the first non-ASCII digit, leading to mismatches between input and parsed date. This can cause logic relying on parsed dates, such as expiry or retention checks, to behave incorrectly.