# CVE-2026-60074: libdate-manip-perl: Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric...

CVE-2026-60074 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-60074, released August 5, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-60074
- Priority: High
- CVSS: 7.5 (high)
- EPSS: 0.0063
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 30, 2026

## Description

Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check.  The parse regexes capture year, month and day with the `\d` shorthand, which on a character string matches the whole Unicode decimal digit property `\p{Nd}` and not just `[0-9]`. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone (`$y<1 || $y>9999`, `$m<1 || $m>12`, `$d<1 || $d>$days`), and _parse_check stores the numified fields (`$y+0`). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (`0?[0-9]`, `[0-5][0-9]`) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction.  Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libdate-manip-perl Debian 14 | 6.99-2 | [DEBIAN-CVE-2026-60074](https://patchblox.com/security/data/fix/linux/debian-cve-2026-60074.md) | Aug 5, 2026 |
| Linux | perl-Date-Manip amzn 2023 | 6.85-1.amzn2023.0.3 | [ALAS2023-2026-2050](https://patchblox.com/security/data/fix/linux/alas2023-2026-2050.md) | Aug 17, 2026 |
| Linux | perl-Date-Manip opensuse-leap 16.0 | 6.960.0-160000.3.1 | [OPENSUSE-SU-2026:21552-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21552-1.md) | Aug 10, 2026 |
| Linux | perl-Date-Manip sles 15.6 | 6.70-150000.4.3.1 | [SUSE-SU-2026:3551-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3551-1.md) | Aug 10, 2026 |
| Linux | perl-Date-Manip sles 15.7 | 6.70-150000.4.3.1 | [SUSE-SU-2026:3551-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3551-1.md) | Aug 10, 2026 |
| Linux | perl-Date-Manip sles 16.0 | 6.960.0-160000.3.1 | [SUSE-SU-2026:23229-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23229-1.md) | Aug 10, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.