Log in Start free

Vulnerability · Published Jul 30, 2026 · Assigned by CPANSec

CVE-2026-60074Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check

High 7.5

In plain English

A high-severity security flaw in Date-Manip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 49.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with the `\d` shorthand, which on a character string matches the whole Unicode decimal digit property `\p{Nd}` and not just `[0-9]`. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone (`$y<1 || $y>9999`, `$m<1 || $m>12`, `$d<1 || $d>$days`), and _parse_check stores the numified fields (`$y+0`). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (`0?[0-9]`, `[0-5][0-9]`) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction. Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libdate-manip-perlno fix listedDEBIAN-CVE-2026-60074
Debian:13libdate-manip-perlno fix listedDEBIAN-CVE-2026-60074
Debian:14libdate-manip-perl6.99-2DEBIAN-CVE-2026-60074
Ubuntu:22.04:LTSlibdate-manip-perlno fix listedUBUNTU-CVE-2026-60074
Ubuntu:24.04:LTSlibdate-manip-perlno fix listedUBUNTU-CVE-2026-60074
Ubuntu:26.04:LTSlibdate-manip-perlno fix listedUBUNTU-CVE-2026-60074

Affected products (as reported)

VendorProductVersions
Date-Manip 0 – through 7.00

Weakness: CWE-1289 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References