/ 
Date-Manip-6.99
⭐ Starred 10 / Date::Manip::History
Security Advisories (2)
CVE-2026-60074 (2026-07-30)

Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with the `\d` shorthand, which on a character string matches the whole Unicode decimal digit property `\p{Nd}` and not just `[0-9]`. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone (`$y<1 || $y>9999`, `$m<1 || $m>12`, `$d<1 || $d>$days`), and _parse_check stores the numified fields (`$y+0`). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (`0?[0-9]`, `[0-5][0-9]`) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction. Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.

CVE-2026-60075 (2026-07-30)

Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes. Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.

NAME

Date::Manip::History - Twenty years and still going strong

TWENTY YEARS

I just realized (Dec 2015) that Date::Manip turned twenty years old earlier this year, so I wanted to write some thoughts I have about Date::Manip.

The history of Date::Manip can be broken into several periods.

Birth of Date::Manip (1995-1996)

1995 was the year I really started using perl to automate some of my common tasks. At the time, I was running programs using a number of different batch systems that needed dates entered in a variety of different formats. It was frustrating to remember what format for what batch system, so I wrote some wrappers which would take a few common formats that I wanted to use and would turn those dates into whatever format the batch system needed.

After a few different wrapper scripts (where I copied the date handling code between the scripts), I gathered all of the date routines into one package.

This was the birth of Date::Manip.

I kept it that way for about half a year. By that time, I was thoroughly in love with perl and wanted to contribute.

At the time, CPAN was just a fledgling site, but in October, I released my first package. It wasn't really a module at that time... it was crudely put together and extremely limited use. Even so, it got some very positive initial feedback which spurred the early growth.

There were several private versions followed by 4 public releases (4.0 through 4.3) during this period.

Soon, I had adopted many of the best practices of the day and converted it to a full-blown module.

Active development (1996-2001)

The next 5 years were extremely active. Based on suggestions and requests, functionality increased dramatically, and before long, Date::Manip was considered the goto module for Date operations.

During this period, a number of other modules came along that did a small subset of the functions of Date::Manip (most of them significantly faster), but none had the scope of Date::Manip.

During this period, I recognized that the single biggest weakness was the inability to correctly handle timezones and daylight saving time. Towards the end of this period (2000 I believe), I began a project to rewrite Date::Manip, but I didn't have the time needed to really carry it out at that time.

Another weakness was that Date::Manip grew in a random way. As ideas and suggestions came, I added them. There was little planning or forethought involved, and that led to it not having a consistent API.

1998 did see the addition of Recurrences. Although not an extremely widely used piece of functionality, I regard this as the single most important contribution I have ever made. I developed the notation for specifying recurring events, and no other notation has ever come close to matching it's power and flexibility.

This period, starting with the first release in a full module form, included 26 releases (from 5.00 to 5.40).

Minimal maintenance (2001-2008)

During these years, I was able to devote time needed to maintain the existing module, but not to do major development.

As a result, the rewrite project remained incomplete (and in fact, it was barely started).

During this time, due to the fact that no other module could handle timezones correctly, DateTime arrived in 2003. It featured a nice object-oriented interface, and handled timezones.

Over the next few years, it became the de facto standard for date handling in perl.

This period included only 8 releases (5.42 to 5.54).

Rewrite (2009-2010)

In 2009, I decided it was time to fix the timezone problems in Date::Manip . Some people might see this as a waste of time due to the fact that DateTime existed, but I had several thoughts.

First, many people continued to use Date::Manip. This was evident by the number of emails I continued to receive.

Second, there were still things that Date::Manip did better than DateTime including recurrences and parsing.

Third, I love my module, and didn't want to see it die. I'll continue to use it, even if nobody else does.

So, I set out to fix it. It turned out to be a complete rewrite, but in the end, version 6 was released with full timezone handling, even better parsing, and quite a few other features.

Date::Manip was once again very much alive.

This period featured 13 releases (6.00 to 6.14) with an additional 2 maintenance releases of version 5.

Active maintenance (2010-present)

Although primarily in maintenance mode (due to the fact that it does pretty much everything that it was designed to do), active maintenance continues. There is also some development and a large number of significant improvements have been made in this period.

I make regular releases to update the timezone information, fix bugs, and add the occasional new features.

For the foreseeable future, Date::Manip will remain active, and fully capable of handling any common date operation.

Since 6.14, there have been an average of about 5 releases per year.

ONE OF THE OLDEST

I was curious to see how many other modules are out there that have survived as long as Date::Manip.

The first public release of Date::Manip (though it was not a module at that point) was version 4.0 on 13-Aug-1995. The first public release to CPAN was version 4.2 released on 23-Oct-1995.

I got a list of all CPAN modules from the wayback machine for 2000 (the earliest version of the list that I could find). Then I checked each of these authors on backpan to see which of these authors had packages (.tar.gz or .tgz files) released prior to 23-Oct-1995.

I found that at the time Date-Manip 4.2 was released there were

32 authors
70 packages

There are currently (Aug 2017) over 190,000 modules by over 13,000 authors. So Date::Manip got involved in CPAN very early.

Next, I tried to determine which of those authors and packages are still active. I'm not completely sure about some of the packages because frequently, those old packages have changed maintainers, been renamed, or been incorporated into other packages. So the number of active packages may be missing a couple.

I found that:

13 of the 32 authors are active today
21 of the 70 packages are active today
7 of those packages are still maintained by the original author

An active author is one who has released something in the past 3 years. An active module is one that has been updated in the past 3 years.

I apologize if I have missed anyone.

The 7 packages which are older than Date::Manip and are still actively maintained by their original author (though they may have been renamed) are:

ILYAZ  MathPari     23-Jan-1995
ANDK   Symdump      16-Aug-1995
PMQS   Filter       28-Aug-1995
GAAS   libwww-perl  16-Sep-1995
LDS    GD           17-Sep-1995
MEWP   sybperl      02-Oct-1995
TOMZO  Quota        10-Oct-1995

Congratulations to those authors who have been with perl since the beginning. I'm proud to be in their company! And congratulations to ILYAZ for having the oldest module in CPAN!

If I have missed anyone, please let me know.

2022 Update:

Three of the above packages have now been removed from the list.

Symdump has not been updated since 2017, though the author is still active, and the package is still available.

Filter and GD are still maintained but by new authors.

So, it seems like we're down to 4 packages that are actively maintained by the original author that are older than Date::Manip.

SEE ALSO

Date::Manip - main module documentation

LICENSE

This script is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

AUTHOR

Sullivan Beck (sbeck@cpan.org)