https://bugzilla.redhat.com/show_bug.cgi?id=2515195
Bug ID: 2515195
Summary: CVE-2026-60075 perl-Date-Manip: Date::Manip for Perl:
Denial of Service via CPU exhaustion in date parsing
[fedora-all]
Product: Fedora
Version: rawhide
Status: NEW
Whiteboard: {"flaws": ["e04e4b26-6169-40e3-8b5c-5a4770dc9886"]}
Component: perl-Date-Manip
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected], [email protected],
[email protected], [email protected],
[email protected]
Blocks: 2509486 (CVE-2026-60075)
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic
backtracking in the unanchored time substitution in _parse_time.
_parse_time removes a time from anywhere in the string with the unanchored
substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of
time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine therefore
retries the match at every position of an interior whitespace run: at each
start position the leading `\s+` consumes the rest of the run greedily, the
time alternation fails because the run holds no digits, and the engine
backtracks a space at a time across the run before advancing the start
position, which is quadratic in the length of the run. No time need be present
in the string for this to happen, only a long run of whitespace, and the parse
time rises about fourfold for each doubling of the run: a few kilobytes of
whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.
Any caller that passes an untrusted string of unbounded length to ParseDate(),
Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU
in a single parse, a denial of service.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2509486
[Bug 2509486] CVE-2026-60075 perl-Date-Manip: Date::Manip for Perl: Denial of
Service via CPU exhaustion in date parsing
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2515195
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202515195%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
