Critical Denial of Service Vulnerability in perl-Date-Manip Package
Summary
ALSA-2026:57562: Important: perl-Date-Manip security update. Affects perl-Date-Manip versions < 6.60-3.el8_10.1. Fixed in 6.60-3.el8_10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
perl-Date-Manip is a Perl module that simplifies date and time operations, including comparisons, calculations, and parsing of international times. It is designed to handle the complexities of the Gregorian calendar, including daylight saving time adjustments. However, it has been found to be vulnerable to a Denial of Service (DoS) attack, which can exhaust CPU resources during date parsing operations.
Vulnerability Detail
The vulnerability, identified as CVE-2026-60075, allows an attacker to exploit the date parsing functionality of the perl-Date-Manip package, leading to CPU exhaustion. This can result in a Denial of Service, where legitimate users are unable to access the service due to resource depletion. The issue arises from inefficient handling of certain date formats, which can be manipulated to create excessive computational demands.
How To Fix
Minimum fixed version
6.60-3.el8_10.1
This is the first release that contains the fix.
sudo dnf update perl-Date-ManipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using untrusted input for date parsing operations. Implement input validation to ensure that only expected date formats are processed, thereby reducing the risk of triggering the vulnerability.
Conclusion
The perl-Date-Manip package has a critical vulnerability that can lead to Denial of Service attacks through CPU exhaustion. It is essential to update to the latest patched version to safeguard your applications. Additionally, employing input validation can serve as a temporary measure until the update can be applied.
See every vulnerability recorded for perl-Date-Manip →
FAQ
CVE-2026-60075 is a security vulnerability in the perl-Date-Manip package that allows for Denial of Service attacks through CPU exhaustion during date parsing.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without needing to install anything.
The primary impact is a Denial of Service, where the application may become unresponsive due to excessive CPU usage caused by malicious date parsing requests.
Yes, a patch is available in version 6.60-3.el8_10.1 of the perl-Date-Manip package. It is recommended to update to this version to mitigate the vulnerability.
If an immediate update is not possible, implement input validation to restrict date formats and avoid processing untrusted input to minimize the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for perl-Date-Manip.
