CPU exhaustion via regex backtracking in Perl HTTP::Date (CVE-2026-14741)

HTTP::Date versions before 6.08 for Perl contain inefficient regular expression complexity (CWE-1333) in the `parse_date()` function, where unbounded quantifiers placed adjacently before a trailing anchor cause polynomial (approximately quadratic) backtracking. An attacker supplying a crafted date string of a few tens of kilobytes to any caller of `str2time()` or `parse_date()` - including processing of untrusted HTTP `Date`, `Expires`, or `Last-Modified` headers - can cause tens of seconds of CPU consumption, resulting in denial of service. Affected versions: - before 6.08 We recommend updating to: 6.08. CVSS 7.5 · our assessment: this_week Reference: https://seclists.org/oss-sec/2026/q3/167 Details: https://vuln.today/cve/CVE-2026-14741