Denial of Service Vulnerability in perl-Date-Manip Package
Summary
ALSA-2026:56970: Important: perl-Date-Manip security update. Affects perl-Date-Manip versions < 6.85-3.el9_8.1. Fixed in 6.85-3.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
perl-Date-Manip is a Perl module designed to simplify date and time operations, including comparisons, calculations, and parsing of international time formats. It fully supports the Gregorian calendar and accounts for daylight saving time changes. This package is widely used in applications that require robust date manipulation functionalities.
Vulnerability Detail
The vulnerability identified as CVE-2026-60075 allows for a Denial of Service (DoS) attack through CPU exhaustion during date parsing operations. An attacker can exploit this vulnerability by providing specially crafted input that causes excessive CPU usage, potentially leading to application unavailability. This issue arises from inefficient handling of date parsing logic within the module.
How To Fix
Minimum fixed version
6.85-3.el9_8.1
This is the first release that contains the fix.
sudo dnf update perl-Date-ManipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to limit the complexity of date strings being parsed. This may help mitigate the risk of CPU exhaustion until the package is updated.
Conclusion
The perl-Date-Manip package has a critical vulnerability (CVE-2026-60075) that can lead to Denial of Service attacks. It is essential to update to the patched version to ensure application security. Additionally, using Vulert can help monitor vulnerabilities in your software effectively.
See every vulnerability recorded for perl-Date-Manip →
FAQ
CVE-2026-60075 is a vulnerability in the perl-Date-Manip package that allows for Denial of Service attacks through CPU exhaustion during date parsing.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring installation.
The primary impact is application downtime due to excessive CPU usage, which can lead to service unavailability for users.
Yes, the patched version of perl-Date-Manip is 6.85-3.el9_8.1. Updating to this version will resolve the vulnerability.
If an immediate update is not possible, consider implementing input validation as a temporary workaround to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for perl-Date-Manip.
