CVE-2026-60075 SBECK CVE debrief

Who should care

Developers and administrators using Date::Manip in Perl applications, especially those that parse untrusted input, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing the official advisory, validating affected scope and severity, and implementing input validation and sanitization for untrusted strings. Additionally, operators, platform administrators, and security teams should review compensating controls and implement rate limiting or other controls to prevent excessive CPU consumption.

Technical summary

The _parse_time function in Date::Manip versions through 6.99 for Perl is vulnerable to CPU exhaustion via quadratic backtracking in the unanchored time substitution. This occurs when the function attempts to parse a string with a long run of whitespace, causing the engine to retry the match at every position of the whitespace run. This can lead to significant CPU consumption and potential denial of service. The vulnerability can be triggered by passing an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time().

Defensive priority

High-priority defensive actions are required to mitigate the risk of CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.

Recommended defensive actions

• Update Date::Manip to a version that fixes the vulnerability
• Implement input validation and sanitization for untrusted strings passed to ParseDate(), Date::Manip::Date->parse() or ->parse_time()
• Monitor CPU usage and implement rate limiting or other controls to prevent excessive CPU consumption
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-60075 vulnerability in Date::Manip versions through 6.99 for Perl allows CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. Evidence is based on official CVE and NVD records, as well as source references from Metacpan and Openwall. The vulnerability can be triggered by passing an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time(), which can lead to significant CPU consumption and potential denial of service. To verify and mitigate this vulnerability, defenders should review the official advisory, validate affected scope and severity, and implement input validation and sanitization for untrusted strings.

Official resources