Critical Denial of Service Vulnerability in perl-Date-Manip Package
Summary
ALSA-2026:56971: Important: perl-Date-Manip security update. Affects perl-Date-Manip versions < 6.94-5.el10_2.1. Fixed in 6.94-5.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
perl-Date-Manip is a Perl module that simplifies date and time operations, allowing users to easily perform tasks such as comparing times, calculating future dates, and parsing international time formats. It fully supports the Gregorian calendar and accounts for daylight saving time changes. However, a recent security vulnerability has been identified that could lead to significant performance issues.
Vulnerability Detail
The vulnerability, identified as CVE-2026-60075, allows for a Denial of Service (DoS) attack through CPU exhaustion during date parsing operations. An attacker can exploit this vulnerability by sending specially crafted date strings to the application, causing it to consume excessive CPU resources and potentially leading to service unavailability. This issue arises from inefficient handling of certain date formats within the Date::Manip module.
How To Fix
Minimum fixed version
6.94-5.el10_2.1
This is the first release that contains the fix.
sudo dnf update perl-Date-ManipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to restrict the formats of date strings accepted by your application. This can help mitigate the risk of triggering the vulnerability until an update can be applied.
Conclusion
The perl-Date-Manip package has a critical vulnerability (CVE-2026-60075) that can lead to Denial of Service attacks. It is crucial to update to the patched version to protect your application from potential exploitation. Additionally, consider using Vulert to monitor for vulnerabilities in your software.
See every vulnerability recorded for perl-Date-Manip →
FAQ
CVE-2026-60075 is a security vulnerability in the perl-Date-Manip package that allows for Denial of Service attacks through CPU exhaustion.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Exploiting this vulnerability can lead to significant performance degradation or complete service unavailability due to excessive CPU consumption.
Yes, the patched version of perl-Date-Manip is 6.94-5.el10_2.1. Updating to this version will resolve the vulnerability.
Implement input validation to restrict date formats accepted by your application as a temporary workaround until you can apply the update.
Related vulnerabilities
Recent vulnerabilities recorded for perl-Date-Manip.
