Live › vulnerability › CVE-2026-87768
DateTime::Lite before 0.8.1 loops once per day when adding seconds to a date with a fixed time zone, so a large value keeps the CPU busy. An attacker who controls the number of seconds added can hold the process for as long as they choose.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 13:30 UTC. All times on this page are UTC.
Any Perl application that calls add(seconds => ...) on a DateTime::Lite object with a non-floating time zone, and passes in a seconds value an outside party can influence. Code that only uses hard-coded or internally generated values, or that does not use DateTime::Lite, is not exposed in the same way. unknown whether the sources list which features are most exposed.
No product ranges from the sources yet.
perl -MDateTime::Lite -e 'print $DateTime::Lite::VERSION'DateTime::Lite (for example cpanm --info DateTime::Lite or your cpanfile / Makefile.PL)0.8.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds.
_normalize_leap_seconds crosses day boundaries one day at a time, so add(seconds => $n) on an object with a non-floating time zone takes about |$n|/86400 iterations, and nothing limits $n. The XS implementation and the pure-Perl fallback both have the loop.
An attacker who controls the number of seconds added can keep the process busy for as long as they choose.
This page as .md · .json · in your agent: get_signal("CVE-2026-87768")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.