Skip to main content

Date EUVDEUVD-2026-51124

| CVE-2026-60074 HIGH
Improper Validation of Unsafe Equivalence in Input (CWE-1289)
2026-07-30 CPANSec GHSA-hfqp-m279-7mj7
Information Disclosure Date
7.5
CVSS 3.1 · Vendor: CPANSec
View

Vulnerability Assessment

Weakness
CWE
CWE-1289
ASVS 5.0
V15 - Secure Coding and Architecture Hardware access control
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 31, 2026

Silent date corruption in Date::Manip through version 6.99 allows any caller passing untrusted character strings to ParseDate() or Date::Manip::Date->parse() to receive silently incorrect parsed dates when non-ASCII Unicode decimal digits (such as Arabic-Indic, Devanagari, or other Unicode script numerals) appear in year, month, or day fields. Perl's \d regex shorthand matches the full Unicode decimal-digit property (\p{Nd}), so non-ASCII digits are captured; subsequent numeric range validation then passes them because Perl truncates the string-to-number conversion at the first non-ASCII character, producing an in-range but wrong value — for example, '202٤' evaluates to year 202, not 2024. No public exploit has been identified at time of analysis and EPSS is very low (0.19%), but SSVC flags the flaw as automatable and the impact is meaningful for any application where Date::Manip parses externally-supplied dates to gate expiry checks, retention windows, or access-control logic.

Affected VersionsENISA

Date::Manip 0 ≤6.99

Affected Packages

euvd date_manip no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Date gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CPANSec) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Red Hat 4.3 MEDIUM

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
Jul 31, 2026 - 18:37 NVD
7.5 (HIGH)
CVE Published
Jul 30, 2026 - 13:42 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 30, 2026 - 13:42 cve.org
HIGH 7.5

DescriptionCVE.org

Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check.

The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \p{Nd} and not just [0-9]. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone ($y<1 || $y>9999, $m<1 || $m>12, $d<1 || $d>$days), and _parse_check stores the numified fields ($y+0). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (0?[0-9], [0-5][0-9]) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction.

Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.

Executive ViewAI

Why It Matters

Date::Manip (Perl) versions through 6.99 silently corrupt dates when parsing non-ASCII Unicode numerals, potentially breaking date-based security controls such as expiry validation and access-control gates. Organizations relying on Date::Manip for access control or compliance-critical date logic face risk of authorization bypass or audit failures without patching.

Recommended Action

Within 24 hours, inventory systems and applications using Date::Manip and their current versions; assess whether they parse untrusted user input or external data sources. Within 7 days, upgrade all Date::Manip instances to the patched version released by the vendor; prioritize systems handling access-control or compliance-sensitive date operations. Within 30 days, validate the upgrade by testing date parsing with international numeric characters and reviewing application logs for date-parsing anomalies.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 91% exploitable
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Date

View all
CVE-2026-60075 HIGH
7.5 Jul 30

CPU exhaustion in the Perl module Date::Manip through version 6.99 allows unauthenticated remote attackers to cause unbo
CVE-2012-1626 MEDIUM
6.0 Sep 20

SQL injection vulnerability in the conversion form for Events in the Date module 6.x-2.x before 6.x-2.8 for Drupal allow
CVE-2014-5169 LOW
3.5 Oct 20

Cross-site scripting (XSS) vulnerability in the Date module before 7.x-2.8 for Drupal allows remote authenticated users

Same weakness CWE-1289 – Improper Validation of Unsafe Equivalence in Input

View all
CVE-2024-45179 HIGH POC
7.2
CVE-2024-45308 MEDIUM POC
6.5
CVE-2026-100255 CRITICAL
9.8
CVE-2022-0675 CRITICAL
9.8
CVE-2026-39821 CRITICAL
9.6
CVE-2026-101015 MEDIUM POC
5.5
CVE-2026-97196 CRITICAL
9.1
CVE-2026-86831 HIGH
8.7

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

References

Advisories & patches
PATCH https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60074-r1.patch ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-60074 ADVISORY https://seclists.org/oss-sec/2026/q3/344 ADVISORY https://vuldb.com/vuln/384813 REF http://www.openwall.com/lists/oss-security/2026/07/30/19 REF https://github.com/SBECK-github/Date-Manip/pull/54 REF https://metacpan.org/release/SBECK/Date-Manip-6.99/source/lib/Date/Manip/Base.pm#L602-614 REF https://metacpan.org/release/SBECK/Date-Manip-6.99/source/lib/Date/Manip/Date.pm#L1536-1539

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy