Date::Manip versions through 6.99 for Perl

CVE-2026-60075 is a Regular Expression Denial of Service (ReDoS) in the Perl module Date::Manip through version 6.99. The vulnerable code path is _parse_time, which uses an unanchored substitution s/$timerx/ / where $timerx begins with a (?:$atrx|^|\s+) alternation. When a string containing a long run of whitespace (no actual time component needed) is passed to ParseDate(), Date::Manip::Date->parse(), or ->parse_time(), the regex engine retries the match at every whitespace position, backs track greedily across the rest, and produces quadratic CPU cost — a few kilobytes of spaces cost seconds, tens of kilobytes cost minutes. The impact is strictly availability: no code execution, no data leak.

The vendor CVSS of 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is *technically defensible in isolation* — if an attacker can send a crafted string over the network to a service that pipes it straight into ParseDate() without length limits, the DoS lands. In practice, however, this overstates reality. Date::Manip is a utility library embedded in Perl scripts and applications; the attacker can only reach the vulnerable regex through the *calling application*, and most callers either validate input length, parse trusted/internal data (logs, configs, cron expressions), or are not directly network-exposed. The EPSS of 0.00387 (~0.4%) confirms the community agrees exploitation at scale is unlikely. The score should be MEDIUM.

Why this verdict

• Library indirection: The vulnerable code is in a library, not a daemon. Exploitation requires a calling application to pipe untrusted, unbounded input into ParseDate() — this is not the common usage pattern for Date::Manip, which is predominantly used for internal date calculations, log parsing, and scripting.
• Availability-only impact: Even in a successful exploitation, the blast radius is a single CPU-bound worker process. There is no memory corruption, no code execution, no confidentiality or integrity impact. Process supervisors, cgroups, and application timeouts naturally bound the damage.
• Role multiplier: Date::Manip is a general-purpose Perl date library. It is not canonically deployed in high-value roles (domain controllers, hypervisors, identity providers, backup systems, CI/CD). In its most common enterprise context — monitoring scripts, log processors, internal tools — a DoS of one worker thread has negligible fleet-wide impact. There is no plausible chain from this ReDoS to domain takeover, fleet compromise, or supply-chain pivot. The high-value role floor does not apply.
• EPSS confirmation: At 0.00387, the exploit prediction model places this in the bottom quartile, consistent with the assessment that real-world exploitation is unlikely.
• No patch available: While the lack of a patch is not itself a severity driver, it means defenders must rely on input-validation workarounds, which are straightforward for this specific pattern (truncate input length).

Why not higher?

The vendor's HIGH/7.5 rating assumes a deployment where untrusted network input flows directly into ParseDate() without length constraints. While *possible*, this represents a minority of Date::Manip installations. The impact is capped at availability of a single process — there is no escalation path to RCE, data exfiltration, or lateral movement. No KEV listing, no known exploitation, and an EPSS in the bottom quartile all argue against maintaining HIGH.

Why not lower?

Despite the friction, the vulnerability *is* real and trivially reproducible with zero authentication. Some Perl web applications do pass form-field input into date-parsing routines, and a determined attacker could sustain application-layer DoS against such a target. The lack of a vendor patch means there is no simple remediation path, only workarounds. LOW would understate the risk for the subset of deployments where Date::Manip does touch untrusted input.

1. Truncate input before Date::Manip parsing calls — Add a length check before any call to ParseDate(), ->parse(), or ->parse_time(): reject or truncate strings longer than 256 characters. No legitimate date string approaches this length. This eliminates the quadratic cost entirely. Deploy within the 365-day noisgate remediation SLA for MEDIUM findings, or sooner if your application directly parses untrusted input.
2. Set application-level timeouts on Perl workers — Configure your web server or application framework to kill Perl workers that exceed a CPU time threshold (e.g., Apache RLimitCPU, systemd CPUQuota=, Starman/Plack timeouts). This bounds the blast radius of any single-request DoS.
3. Apply WAF rules limiting single-field payload size — Configure your WAF to reject HTTP requests where any single form field or JSON value exceeds a reasonable size (e.g., 1 KB for date fields). This blocks the whitespace-padding attack before it reaches application code.
4. Audit codebase for Date::Manip usage touching untrusted input — Run grep -rn 'ParseDate\|Date::Manip.*parse' /path/to/app to identify all call sites. Classify each as trusted-input or untrusted-input. Prioritize adding length guards on untrusted-input paths.

Run this script on any host where Date::Manip is installed. It checks the installed version via CPAN metadata. No special privileges required. Example: bash check_cve_2026_60075.sh

#!/usr/bin/env bash
# check_cve_2026_60075.sh
# Checks whether the installed Date::Manip version is vulnerable to CVE-2026-60075
# (ReDoS in _parse_time, affects all versions through 6.99)
# Run on target host. No elevated privileges needed.

set -euo pipefail

MODULE="Date::Manip"
FIXED_VERSION="7.00"  # No fix released yet; 7.00 is hypothetical next major

# Check if perl is installed
if ! command -v perl &>/dev/null; then
  echo "UNKNOWN - perl not found on this host"
  exit 2
fi

# Get installed version
INSTALLED=$(perl -MDate::Manip -e 'print $Date::Manip::VERSION' 2>/dev/null || true)

if [ -z "$INSTALLED" ]; then
  echo "UNKNOWN - Date::Manip is not installed"
  exit 2
fi

# Compare versions using perl's version comparison
IS_VULN=$(perl -e '
  use version;
  my $installed = version->parse("'"$INSTALLED"'");
  my $fixed     = version->parse("'"$FIXED_VERSION"'");
  print($installed < $fixed ? "yes" : "no");
' 2>/dev/null || echo "error")

if [ "$IS_VULN" = "yes" ]; then
  echo "VULNERABLE - Date::Manip $INSTALLED is installed (affected: <= 6.99, no patch available)"
  exit 1
elif [ "$IS_VULN" = "no" ]; then
  echo "PATCHED - Date::Manip $INSTALLED is installed (>= $FIXED_VERSION)"
  exit 0
else
  echo "UNKNOWN - could not determine version status (installed: $INSTALLED)"
  exit 2
fi

Sources

1. NVD / CVE-2026-60075
2. Date::Manip on CPAN (latest: 6.99)
3. CISA Weekly Vulnerability Summary (week of 2026-07-13)
4. FIRST EPSS — Exploit Prediction Scoring System
5. Doyensec regexploit — ReDoS detection tooling
6. Date::Manip Changes6 changelog
7. Debian package: libdate-manip-perl