EUVD-2026-45190
GHSA-mcqf-9rr5-v7rw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Untrusted date strings reach the parser remotely with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is CPU-exhaustion availability only, so C:N/I:N/A:H.
Primary rating from Vendor (vendor:alpine).
CVSS VectorVendor: vendor:alpine
Lifecycle Timeline
6DescriptionCVE.org
Alpine Linux: perl-http-date fixed in 6.0.8-r0
AnalysisAI
Denial of service in the Perl HTTP::Date module (libwww-perl's parse_date/str2time) before version 6.08 lets remote attackers exhaust CPU by submitting hostile Date-header-style strings that trigger quadratic regex backtracking (ReDoS). Any application that feeds untrusted date strings - HTTP clients, servers, and mail tooling built on libwww-perl - is affected; a ~40 KB crafted string can burn tens of seconds of CPU per request. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application pass attacker-influenced strings into HTTP::Date's parse_date() or str2time() functions (for example parsing a client-supplied Date, Expires, Last-Modified, or cookie-expiry header) using HTTP::Date before 6.08. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are consistent and point to a genuine-but-bounded availability risk rather than a critical emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade HTTP::Date to version 6.08 or later (Vendor-released patch: HTTP-Date 6.08); on Alpine Linux update the perl-http-date package to 6.0.8-r0 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems and applications using libwww-perl and document current versions in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today