From: CPANSec Security Scanner Bot <cpan-security@security.metacpan.org>
Subject: [PATCH] Date::Manip: cap the length of a string handed to the parsers

CVE-2026-60075.  _parse_time removes a time from anywhere in the string
with the unanchored substitution s/$timerx/ /, where $timerx is an
auto-generated alternation of time patterns reached through a leading
(?:$atrx|^|\s+).  The engine retries the match at every position of an
interior whitespace run: at each start position the leading \s+ consumes
the rest of the run greedily, the time alternation fails because the run
holds no digits, and the engine backtracks a space at a time across the
run before advancing the start position.  The cost is quadratic in the
length of the run, and no time need be present in the string.  On the
machine this patch was tested on, parsing "x" . (" " x 2000) . "x" took
1.7 seconds of CPU and "x" . (" " x 16000) . "x" took 107 seconds,
rising about fourfold for each doubling of the run.

Fix: reject a string longer than $MAXLENGTH (256) at the parse and
parse_time entries, before any regex runs, which is the shape of the fix
libwww-perl shipped in HTTP::Date 6.08 for the same weakness class.
Legitimate date strings are well under 100 characters, and a 42 entry
corpus of legitimate formats parses to the same value before and after.

diff --git a/lib/Date/Manip/Date.pm b/lib/Date/Manip/Date.pm
index 7699921..859cef5 100644
--- a/lib/Date/Manip/Date.pm
+++ b/lib/Date/Manip/Date.pm
@@ -94,6 +94,13 @@ sub input {
 # DATE PARSING
 ########################################################################
 
+# The longest string the parsers will look at.  The time matching
+# regexp is applied unanchored, so the cost of failing to match grows
+# with the square of the length of an interior whitespace run.  Real
+# date strings are well under 100 characters.
+
+our $MAXLENGTH = 256;
+
 sub parse {
    my($self,$instring,@opts) = @_;
    $self->_init();
@@ -104,6 +111,11 @@ sub parse {
       return 1;
    }
 
+   if (length($instring) > $MAXLENGTH) {
+      $$self{'err'} = '[parse] Date string too long';
+      return 1;
+   }
+
    my %opts     = map { $_,1 } @opts;
 
    my $dmt = $$self{'tz'};
@@ -382,6 +394,11 @@ sub parse_time {
       return 1;
    }
 
+   if (length($string) > $MAXLENGTH) {
+      $$self{'err'} = '[parse_time] Time string too long';
+      return 1;
+   }
+
    my($y,$m,$d,$h,$mn,$s);
 
    if ($$self{'err'}) {