CVE-2026-60075

Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes. Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.

• CWE-1333

• https://metacpan.org/release/SBECK/Date-Manip-6.99/source/lib/Date/Manip/Date.pm#L1526
• https://metacpan.org/release/SBECK/Date-Manip-6.99/source/lib/Date/Manip/Date.pm#L1811
• https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60075-r1.patch
• http://www.openwall.com/lists/oss-security/2026/07/30/20

Published

Jul 30, 2026

Last Modified

Jul 31, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-60062The NGINX Agent config_dirs directive allows a low-privilege…6.4
• CVE-2026-60063An out-of-bounds write vulnerability in the Productivity Sui…7.3
• CVE-2026-60065When NGINX Plus is configured to use the Message Queuing Tel…5.3
• CVE-2026-6007A vulnerability was found in itsourcecode Construction Manag…6.3
• CVE-2026-60073An out-of-bounds read in the Productivity Suite allows a phy…5.9
• CVE-2026-60074Date::Manip versions through 6.99 for Perl return corrupted …7.5
• CVE-2026-6008Authorization bypass through User-Controlled key vulnerabili…6.8
• CVE-2026-60080Use After Free vulnerability in the Rust deserialization log…7.3
• CVE-2026-60081DBI::ProfileData versions before 1.651 for Perl do not limit…7.5
• CVE-2026-60082DBI versions before 1.651 for Perl do not enforce statement …9.1
• CVE-2026-60085PraisonAI before 4.6.78 contains an unenforced security poli…8.7
• CVE-2026-60086PraisonAI before 4.6.78 contains a prompt injection defense …6.9