/ 
Date-Manip-6.43
/ internal/langpod
Security Advisories (2)
CVE-2026-60074 (2026-07-30)

Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with the `\d` shorthand, which on a character string matches the whole Unicode decimal digit property `\p{Nd}` and not just `[0-9]`. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone (`$y<1 || $y>9999`, `$m<1 || $m>12`, `$d<1 || $d>$days`), and _parse_check stores the numified fields (`$y+0`). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (`0?[0-9]`, `[0-5][0-9]`) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction. Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.

CVE-2026-60075 (2026-07-30)

Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading `\s+` consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes. Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded CPU in a single parse, a denial of service.

$hdstr NAME

Date::Manip::Lang::${mod} - ${name} language support.

$hdstr SYNOPSIS

This module contains a list of words and expressions supporting the language. It is not intended to be used directly (other Date::Manip modules will load it as needed).

$hdstr LANGUAGE EXPRESSIONS

The following is a list of all language words and expressions used to write times and/or dates.

All strings are case insensitive.

Month names and abbreviations

When writing out the name of the month, several different variations may exist including full names and abbreviations.

The following month names may be used:

$words{month_name}[0] $words{month_name}[1] $words{month_name}[2] $words{month_name}[3] $words{month_name}[4] $words{month_name}[5] $words{month_name}[6] $words{month_name}[7] $words{month_name}[8] $words{month_name}[9] $words{month_name}[10] $words{month_name}[11]

The following abbreviations may be used:

$words{month_abb}[0] $words{month_abb}[1] $words{month_abb}[2] $words{month_abb}[3] $words{month_abb}[4] $words{month_abb}[5] $words{month_abb}[6] $words{month_abb}[7] $words{month_abb}[8] $words{month_abb}[9] $words{month_abb}[10] $words{month_abb}[11]

Day names and abbreviations

When writing out the name of the day, several different variations may exist including full names and abbreviations.

The following day names may be used:

$words{day_name}[0] $words{day_name}[1] $words{day_name}[2] $words{day_name}[3] $words{day_name}[4] $words{day_name}[5] $words{day_name}[6]

The following abbreviations may be used:

$words{day_abb}[0] $words{day_abb}[1] $words{day_abb}[2] $words{day_abb}[3] $words{day_abb}[4] $words{day_abb}[5] $words{day_abb}[6]

The following short (1-2 characters) abbreviations may be used:

$words{day_char}[0] $words{day_char}[1] $words{day_char}[2] $words{day_char}[3] $words{day_char}[4] $words{day_char}[5] $words{day_char}[6]

Delta field names

These are the names (and abbreviations) for the fields in a delta. There are 7 fields: years, months, weeks, days, hours, minutes, seconds.

The names and abbreviations for these fields are:

$words{fields}[0] $words{fields}[1] $words{fields}[2] $words{fields}[3] $words{fields}[4] $words{fields}[5] $words{fields}[6]

Morning/afternoon times

This is a list of expressions use to designate morning or afternoon time when a time is entered as a 12-hour time rather than a 24-hour time. For example, in English, the time "17:00" could be specified as "5:00 PM".

Morning and afternoon time may be designated by the following sets of words:

$words{ampm}[0] $words{ampm}[1]

Each or every

There are a list of words that specify every occurence of something. These are used in the following phrases:

EACH Monday
EVERY Monday
EVERY month

The following words may be used:

$words{each}

Next/Previous/Last occurence

There are a list of words that may be used to specify the next, previous, or last occurence of something. These words could be used in the following phrases:

NEXT week

LAST tuesday
PREVIOUS tuesday

LAST day of the month

The following words may be used:

Next occurence:

$words{nextprev}[0]

Previous occurence:

$words{nextprev}[1]

Last occurence:

$words{last}

Delta words for going forward/backward in time

When parsing deltas, there are words that may be used to specify the the delta will refer to a time in the future or to a time in the past (relative to some date). In English, for example, you might say:

IN 5 days
5 days AGO

The following words may be used to specify deltas that refer to dates in the past or future respectively:

$words{when}[0] $words{when}[1]

Business mode

This contains two lists of words which can be used to specify a standard (i.e. non-business) delta or a business delta.

Previously, it was used to tell whether the delta was approximate or exact, but now this list is not used except to force the delta to be standard.

The following words may be used:

$words{mode}[0]

The following words may be used to specify a business delta:

$words{mode}[1]

Numbers

Numbers may be spelled out in a variety of ways. The following sets correspond to the numbers from 1 to 53:

$words{nth}[0] $words{nth}[1] $words{nth}[2] $words{nth}[3] $words{nth}[4] $words{nth}[5] $words{nth}[6] $words{nth}[7] $words{nth}[8] $words{nth}[9]

$words{nth}[10] $words{nth}[11] $words{nth}[12] $words{nth}[13] $words{nth}[14] $words{nth}[15] $words{nth}[16] $words{nth}[17] $words{nth}[18] $words{nth}[19]

$words{nth}[20] $words{nth}[21] $words{nth}[22] $words{nth}[23] $words{nth}[24] $words{nth}[25] $words{nth}[26] $words{nth}[27] $words{nth}[28] $words{nth}[29]

$words{nth}[30] $words{nth}[31] $words{nth}[32] $words{nth}[33] $words{nth}[34] $words{nth}[35] $words{nth}[36] $words{nth}[37] $words{nth}[38] $words{nth}[39]

$words{nth}[40] $words{nth}[41] $words{nth}[42] $words{nth}[43] $words{nth}[44] $words{nth}[45] $words{nth}[46] $words{nth}[47] $words{nth}[48] $words{nth}[49]

$words{nth}[50] $words{nth}[51] $words{nth}[52]

Ignored words

In writing out dates in common forms, there are a number of words that are typically not important.

There is frequently a word that appears in a phrase to designate that a time is going to be specified next. In English, you would use the word AT in the example:

December 3 at 12:00

The following words may be used:

$words{at}

Another word is used to designate one member of a set. In English, you would use the words IN or OF:

1st day OF December
1st day IN December

The following words may be used:

$words{of}

Another word is use to specify that something is on a certain date. In English, you would use ON:

ON July 5th

The following words may be used:

$words{on}

Words that set the date, time, or both

There are some words that can be used to specify a date, a time, or both relative to now.

Words that set the date are similar to the English words 'yesterday' or 'tomorrow'. These are specified as a delta which is added to the current time to get a date. The time is NOT set however, so the delta is only partially used (it should only include year, month, week, and day fields).

The following words may be used:

$words{offset_date}

Words that set only the time of day are similar to the English words 'noon' or 'midnight'.

The following words may be used:

$words{times}

Words that set the entire time and date (relative to the current time and date) are also available.

In English, the word 'now' is one of these.

The following words may be used:

$words{offset_time}

Hour/Minute/Second separators

When specifying the time of day, the most common separator is a colon (:) which can be used for both separators.

Some languages use different pairs. For example, French allows you to specify the time as 13h30:20, so it would use the following pairs:

: :
[h] [:]

The first column is the hour-minute separator and the second column is the minute-second separator. Both are perl regular expressions.

A pair of colons is ALWAY allowed for all languages. If a language allows additional pairs, they are listed here:

$words{seps}

$hdstr KNOWN BUGS

None known.

$hdstr BUGS AND QUESTIONS

Please refer to the Date::Manip::Problems documentation for information on submitting bug reports or questions to the author.

$hdstr SEE ALSO

Date::Manip - main module documentation

$hdstr LICENSE

This script is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

$hdstr AUTHOR

Sullivan Beck (sbeck\@cpan.org)