/ 
Date-Manip-6.79
⭐ Starred 10 / Date::Manip
Security Advisories (2)
CVE-2026-60074 (2026-07-30)

Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with the `\d` shorthand, which on a character string matches the whole Unicode decimal digit property `\p{Nd}` and not just `[0-9]`. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone (`$y<1 || $y>9999`, `$m<1 || $m>12`, `$d<1 || $d>$days`), and _parse_check stores the numified fields (`$y+0`). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (`0?[0-9]`, `[0-5][0-9]`) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction. Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.

CVE-2026-60075 (2026-07-30)

Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes. Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.

NAME

Date::Manip - Date manipulation routines

DESCRIPTION

Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a date a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time.

From the very beginning, the main focus of Date::Manip has been to be able to do ANY desired date/time operation easily. Many other modules exist which may do a subset of these operations quicker or more efficiently, but no other module can do all of the operations available in Date::Manip.

Date::Manip has functionality to work with several fundamental types of data.

dates

The word date is used extensively here and is somewhat misleading. In Date::Manip, a date consists of three pieces of information: a calendar date (year, month, day), a time of day (hour, minute, second), and time zone information. Calendar dates and times are fully handled. Time zones are handled as well, but depending on how you use Date::Manip, there may be some limitations as discussed below.

delta

A delta is an amount of time (i.e. the amount of time between two different dates). Think of it as the duration of an event or the amount of time between two dates.

A delta refers only to an amount of time. It includes no information about a starting or ending date/time. Most people will think of a delta as an amount of time, but the term 'time' is already used so much in this module that I didn't want to use it here in order to avoid confusion.

recurrence

A recurring event is something which occurs on a regular recurring basis.

holidays and events

Holidays and events are basically named dates or recurrences.

Among other things, Date::Manip allow you to:

*

Enter a date in practically any format you choose.

*

Compare two dates, entered in widely different formats to determine which is earlier.

*

Extract any information you want from a date using a format string similar to the Unix date command.

*

Determine the amount of time between two dates, or add an amount of time (a delta) to a date to get a second date.

*

Work with dates using international formats (foreign month names, 12/10/95 referring to October rather than December, etc.).

*

Convert dates from one timezone to another.

*

To find a list of dates where a recurring event happens.

Each of these tasks is trivial (one or two lines at most) with this package.

HOW TO USE DATE::MANIP

There are three different ways to use Date::Manip . There are three interfaces (version 5 functional interface, version 6 functional, and version 6 object-oriented). A complete description of each is included in the Date::Manip::Interfaces document. The recommended (and the only one with access to the full functionality of the module) is using the Object-Oriented interface.

SEE ALSO

Because Date::Manip performs so many operations, the documentation is extensive. It includes the following documents:

Information about the different interfaces

Read this for a detailed description of each of the interfaces, including information on how to choose and use the interface best suited to your situation.

Date::Manip::Interfaces

A complete description of the functional interfaces available. NOTE: it is recommended that you use the OO interface wherever possible as the functional interfaces have some imitations.

A description of the functional interfaces:

Date::Manip::DM5

The version 5 functional interface

Date::Manip::DM6

The version 6 functional interface

Objects and configuration

An introduction to the Date::Manip classes used by the object-oriented interface and how to configure them:

Date::Manip::Objects

An overview of the various Date::Manip modules, and how to use them.

Date::Manip::Config

Information for configuring Date::Manip

Date::Manip object-oriented modules

These are the modules for using the object-oriented interface.

Date::Manip::Obj

This is the base class. All other classes listed here inherit the methods defined in this class.

Date::Manip::Base

A module for doing low-level date operations.

Date::Manip::TZ

A module for working with time zones.

Date::Manip::Date

The module for working with dates.

Date::Manip::Delta

The module for working with deltas (amount of time).

Date::Manip::Recur

The module for working with recurrences (recurring dates).

Timezone information

Date::Manip::DM5abbrevs

Time zone abbreviations used in the version 5 interface.

Date::Manip::Zones

Time zone data included in Date::Manip used in the version 6 interfaces.

Miscellaneous information:

Date::Manip::Calc

Detailed information on how date calculations are done.

Date::Manip::Holidays

Information on defining and using holidays and events.

Date::Manip::ConfigFile

A sample config file.

Date::Manip::Lang

Information about the languages supported by Date::Manip and how to add a new language.

Date::Manip::Lang::english
Date::Manip::Lang::catalan
Date::Manip::Lang::danish
Date::Manip::Lang::dutch
Date::Manip::Lang::finnish
Date::Manip::Lang::french
Date::Manip::Lang::german
Date::Manip::Lang::italian
Date::Manip::Lang::norwegian
Date::Manip::Lang::polish
Date::Manip::Lang::portugue
Date::Manip::Lang::romanian
Date::Manip::Lang::russian
Date::Manip::Lang::spanish
Date::Manip::Lang::swedish
Date::Manip::Lang::turkish

A description of the parseable words in each language currently supported by Date::Manip.

Information about the module and administrative things:

Date::Manip::Migration5to6

Information on changes necessary to scripts when upgrading from 5.xx to 6.xx.

Date::Manip::Changes5

Change log for Date::Manip 5.xx

Date::Manip::Changes5to6

Differences between version 5.xx and 6.00 (including information on upgrading); this contains more details than the Migration5to6 document.

Date::Manip::Changes6

Change log for Date::Manip 6.xx

Date::Manip::Misc

Miscellaneous information about Date::Manip (who should use it; acknowledgments).

Since many other date/time modules exist, some of which may do the specific operation(s) you need faster, be sure to read "SHOULD I USE DATE::MANIP" in Date::Manip::Misc before deciding which of the Date and Time modules from CPAN is for you. However, if you want one module to do it all, Date::Manip is the one to use.

Date::Manip::History

Musings on the history of Date::Manip written around it's 20th birthday.

Date::Manip::Problems

Common problems and instructions for reporting bugs.

Date::Manip::Examples

Examples of how to use Date::Manip.

LICENSE

This script is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

AUTHOR

Sullivan Beck (sbeck@cpan.org)