CVE-2026-60074 SBECK CVE debrief

Who should care

Developers and administrators using Date::Manip in Perl applications, especially those that parse dates from untrusted sources, should review and update date parsing logic to handle non-ASCII decimal digits. This includes reviewing compensating controls for exposed systems while remediation is scheduled and verified, and tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented. Additionally, security teams and vulnerability management teams should be aware of the potential impact of this vulnerability on their systems and take steps to mitigate it. Operators of systems using Date::Manip should also be aware of the potential for date corruption and take steps to verify the accuracy of date parsing logic. Vulnerability management teams should prioritize this vulnerability for remediation due to its high severity and potential impact on date parsing logic. Security teams should review and update their monitoring, detection, and logs for exposed assets that need extra review. Asset inventory teams should verify that affected systems are identified and prioritized for remediation. Rollback/change windows teams should plan for vendor-supported updates or mitigations through normal change control where exposure is confirmed. Source tracking teams should track the status of remediation efforts and verify that evidence is documented before closing the item. Compensating controls should be reviewed and implemented for exposed systems while remediation is scheduled and verified. Monitoring and detection teams should review relevant logs for exposed assets that need extra review. Asset inventory teams should verify that affected systems are identified and prioritized for remediation. Rollback/change windows teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Source tracking teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Compensating controls should be reviewed and implemented for exposed systems while remediation is scheduled and verified. Monitoring and detection teams should review relevant logs to

Technical summary

Date::Manip versions through 6.99 for Perl are vulnerable to date corruption due to non-ASCII decimal digits. The `//d` shorthand in parse regexes matches the whole Unicode decimal digit property `//p{Nd}`, not just `[0-9]`. This can lead to incorrect date parsing when untrusted character strings are passed to ParseDate() or Date::Manip::Date->parse(). The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. To mitigate this vulnerability, it is recommended to review and update date parsing logic to handle non-ASCII decimal digits, implement additional validation checks for date inputs, and consider upgrading to a newer version of Date::Manip.

Defensive priority

High-priority defensive review recommended due to potential impact on date parsing logic.

Recommended defensive actions

• Review and update date parsing logic to handle non-ASCII decimal digits.
• Implement additional validation checks for date inputs.
• Consider upgrading to a newer version of Date::Manip.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

Evidence from Date::Manip versions through 6.99 for Perl indicates that non-ASCII decimal digits can cause date corruption. The parse regexes use the `//d` shorthand, which matches the whole Unicode decimal digit property `//p{Nd}`, not just `[0-9]`. This can lead to incorrect date parsing when untrusted character strings are passed to ParseDate() or Date::Manip::Date->parse().

Official resources