Date::Manip CVE-2026-60075

Exploitation requires that a calling application pass a string of untrusted, unbounded length to one of three Date::Manip parsing entry points: ParseDate(), Date::Manip::Date->parse(), or Date::Manip::Date->parse_time(). No time value needs to be present in the string - a long run of whitespace characters alone (a few kilobytes sufficient for seconds of CPU, tens of kilobytes for minutes) triggers the quadratic backtracking. No special Date::Manip configuration or optional feature enablement is required; the flaw exists in the default parsing path. Exploitation is limited by: (1) the attacker must control input that reaches one of these three specific functions without upstream length validation or sanitisation; (2) per-request size limits imposed by a web server, reverse proxy, or WAF reduce practical payload size; and (3) rate limiting or concurrent-connection caps at the network layer can slow but not prevent a sustained DoS. The CVSS PR:N and UI:N metrics confirm no authentication or user interaction is required once the input reaches the parser.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score 7.5) is internally consistent with the description: the attack is network-reachable, requires no authentication or user interaction, and achieves high availability impact through CPU exhaustion. Real-world priority, however, is moderated. EPSS is 0.19% at the 9th percentile, indicating very low observed exploitation probability in practice. The SSVC exploitation status is 'none,' and there is no CISA KEV listing. The SSVC 'automatable: yes' flag is the most significant risk amplifier - an attacker can script repeated large-whitespace requests against any vulnerable endpoint without any special timing or coordination. Technical impact is rated partial (availability only; no confidentiality or integrity exposure). Risk is therefore conditional: applications that validate input length upstream or that call Date::Manip only on internally generated strings are not meaningfully exposed, while any web-facing endpoint that passes raw user input to ParseDate(), parse(), or parse_time() without length checks is directly vulnerable to resource exhaustion. No conflict between CVSS metrics and description was identified.

An attacker sends repeated HTTP POST requests to a web application's date-input field, populating the value with 50 kilobytes of space characters. The application calls Date::Manip::Date->parse() on the unsanitised string without checking its length. Each call consumes several minutes of CPU due to quadratic backtracking in _parse_time, and a handful of concurrent requests exhaust available worker threads or processes, denying service to legitimate users. No authentication, session token, or vulnerability-specific knowledge beyond the Date::Manip call path is required.