Cloudanix VulnDB

CVE-2026-14741

High · 7.5

CVSS

7.5

EPSS

0.6%

Published

Jul 17, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in a common Perl library lets attackers send specially crafted date information that can make servers slow down or stop responding.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Untrusted date strings passed to parse_date() or str2time() trigger polynomial regex backtracking in HTTP::Date before 6.08, consuming CPU for tens of seconds on a header of tens of kilobytes.

Why it matters to the business

Attackers can remotely exhaust CPU resources on any service that parses untrusted HTTP Date, Expires or Last-Modified headers, causing denial of service and degraded availability.

How an attack unfolds

An attacker crafts an HTTP request containing a valid date prefix followed by a long run of digits or whitespace and a final byte that defeats the trailing anchor, forcing quadratic backtracking when the server calls str2time() on the header value.

How to fix it

Upgrade HTTP::Date to version 6.08 or later. Where immediate upgrade is not possible, add input-size limits or sanitization on date headers before calling parse_date or str2time.

How to confirm the fix worked

Confirm the installed version is 6.08 or newer; test that parse_date returns quickly on a crafted 50 kB malicious date string; monitor CPU usage under load with the same payload.

Typical attack path

  1. Identify a target endpoint that processes incoming HTTP headers with HTTP::Date
  2. Craft a Date/Expires/Last-Modified header value that begins with a plausible timestamp prefix, contains a long interior run of characters, and ends with a single byte that prevents final match
  3. Send the request (or multiple requests) to the target
  4. Observe sustained high CPU usage and eventual service degradation or timeout

How to detect it

Review web-server or application logs for unusually large Date, Expires or Last-Modified header values; correlate with spikes in CPU usage on Perl processes handling HTTP requests.

What your security team should do

  • Prioritize upgrade of HTTP::Date to 6.08+ in all Perl environments that handle external HTTP traffic
  • Add defensive header-size or content validation in front of any call to str2time or parse_date
  • Include this component in regular dependency scanning and patch-management cycles

The record

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date. parse_date() matches the date string against a chain of alternative regexes, and str2time() delegates to it. Several of these patterns place unbounded quantifiers next to each other before a trailing `\s*$` anchor. A valid date prefix followed by a long interior run of digits, letters, or whitespace and a single trailing byte that defeats the final match forces the engine to repartition the run, giving polynomial (about quadratic) backtracking. A header value of a few tens of kilobytes runs for tens of seconds of CPU. HTTP::Date parses timestamps such as HTTP `Date`, `Expires`, and `Last-Modified` headers, which commonly originate from untrusted sources. Any caller that passes an untrusted date header to str2time() or parse_date() can be driven to consume unbounded CPU, a denial of service.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities