Mageia perl-HTTP-Date Important CPU Exhaustion Risk Adv 2026

Back Linuxsecurity

Mageia perl-HTTP-Date Important CPU Exhaustion Risk Adv 2026

Linuxsecurity •LinuxSecurity Advisories • September 1, 2026

Share: View original

Find practical guidance for preventing, investigating, and responding to Linux security problems. Review Linux Privileges ×

Description: HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date

Description: HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date

- - -

-

-

-

- 10/core/perl-HTTP-Date-6.80.0-1.mga10 - 9/core/perl-HTTP-Date-6.80.0-1.mga9

- 10/core/perl-HTTP-Date-6.80.0-1.mga10

- 9/core/perl-HTTP-Date-6.80.0-1.mga9

Publication date: 01 Sep 2026 URL: https: //advisories.mageia.org/MGASA-2026-0362.html Type: security CVE: CVE-2026-14741

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CPU Exhaustion Vulnerabilities in Perl Modules Announced Mageia has issued advisories for two critical vulnerabilities affecting Perl modules Date::Manip and HTTP::Date. The vulnerabilities allow for CPU exhaustion through specific parsing methods, impacting versions of both modules. Date::Manip versions up to 6.99 are affected by non-ASCII decimal digits causing corrupted dates and quadratic backtracking issues. HTTP::Date versions before 6.08 are vulnerable to polynomial regex backtracking in date parsing. These vulnerabilities could potentially lead to denial of service conditions. The CVEs associated with these vulnerabilities are CVE-2026-60074 and CVE-2026-14741. Users are urged to update to the latest versions to mitigate these risks. The advisories were published on September 1, 2026, and highlight the urgency of addressing these flaws. 2 sources 61

Extracted Entities

Attack Types (1)

Denial of Service

CVEs (1)

CWE Weaknesses (1)

CWE-400 - Uncontrolled Resource Consumption

Domains (1)

advisories.mageia.org

MITRE ATT&CK (1)

T1499 - Endpoint Denial of Service

Platforms (1)