Critical Denial of Service Vulnerability in perl-Date-Manip Package
Summary
RLSA-2026:57562: Important: perl-Date-Manip security update. Affects perl-Date-Manip versions < 0:6.60-3.el8_10.1. Fixed in 0:6.60-3.el8_10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
perl-Date-Manip is a Perl module designed to simplify date and time operations, such as comparing times, calculating future dates, and parsing international time formats. It supports the Gregorian calendar and accounts for daylight saving time changes. However, the package is vulnerable to a Denial of Service attack due to CPU exhaustion during date parsing, which can severely impact application performance.
Vulnerability Detail
The vulnerability, identified as CVE-2026-60075, allows an attacker to exploit the date parsing functionality of the perl-Date-Manip package, leading to a Denial of Service condition. This occurs when the module is fed specially crafted date strings that cause excessive CPU usage, potentially bringing down the application or server. The vulnerability is critical, with a CVSS score of 7.5, indicating a high risk to systems using this package.
How To Fix
Minimum fixed version
0:6.60-3.el8_10.1
This is the first release that contains the fix.
sudo dnf update perl-Date-ManipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the date parsing functionality of the perl-Date-Manip package until the package is updated. Additionally, implement input validation to restrict the types of date strings that can be processed by the application.
Conclusion
The perl-Date-Manip package has a critical vulnerability (CVE-2026-60075) that can lead to Denial of Service attacks. It is essential to update to the latest patched version to safeguard your applications. Utilize Vulert to monitor your software for vulnerabilities effectively.
See every vulnerability recorded for perl-Date-Manip →
FAQ
CVE-2026-60075 is a vulnerability in the perl-Date-Manip package that allows for Denial of Service attacks through CPU exhaustion during date parsing.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to application downtime, degraded performance, and potential service outages due to excessive CPU usage.
Yes, a patched version of perl-Date-Manip is available. Update to version 0:6.60-3.el8_10.1 to mitigate the vulnerability.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights.
Related vulnerabilities
Recent vulnerabilities recorded for perl-Date-Manip.
