[CLSA-2026:1788262245] perl-Date-Manip: Fix of CVE-2026-60075
Type:
security
Severity:
Important
Release date:
2026-09-01 11:40:05 UTC
Description:
- CVE-2026-60075: reject a date or time string longer than 256 characters before any parsing regex runs. The unanchored time substitution in _parse_time backtracks quadratically across an interior whitespace run, so a long string of spaces caused CPU exhaustion without containing any time at all. - Drop the test suite invocation and its perl(Test::Inter) and perl(Test::More) build requirements. perl-Test-Inter is not shipped in any AlmaLinux 9.2 repository, so the dependency could not be resolved in the 9.2 buildroot and the binary build failed before the build stage. The test suite is not part of the shipped package.
CVEs fixed:
Updated packages:
  • perl-Date-Manip-6.85-3.el9_2.tuxcare.els1.noarch.rpm
    sha:6d82a59bd0d1d5b5afe4d520cfa2dcddf2b4bb1ddb58843799154a82c3a135a0
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.