CVE-2026-60074

A flaw was found in Date::Manip. This vulnerability allows an attacker to provide specially crafted input containing non-ASCII decimal digits to the Date::Manip library for Perl. The library's parsing logic incorrectly processes these digits, truncating the input and resulting in an inaccurate date being returned without any error indication. This can lead to critical logic errors in applications that depend on precise date parsing, potentially affecting functions like expiry checks or data retention policies.

Red Hat ships the perl-Date-Manip package across RHEL 6 through 10 and RHIVOS. All shipped versions (6.24 through 6.94) are within the affected range. Exploitation requires untrusted input containing non-ASCII Unicode decimal digits to be passed to the Date::Manip parsing functions, limiting practical impact to applications processing internationalized date strings.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Ensure that date input passed to Date::Manip parsing functions is validated to contain only ASCII digits (0-9) before processing.