Fix CVE-2026-60075: prevent ReDoS in perl-Date-Manip date/time parsing

Backport the upstream CVE-2026-60075 fix from CPANSec to
perl-Date-Manip 6.60. The patch adds a $MAXLENGTH=256 constant
and length checks at the entry points of parse() and
parse_time() in lib/Date/Manip/Date.pm, rejecting overly long
input strings before any regex processing. This prevents a
Regular Expression Denial of Service (ReDoS) caused by crafted
strings with long interior whitespace runs that trigger
quadratic backtracking in the unanchored time-matching regex.

CVE: CVE-2026-60075
Upstream patches:
 - https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60075-r1.patch
Resolves: RHEL-239807

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir

perl-Date-Manip-6.60-CVE-2026-60075.patch

@@ -0,0 +1,69 @@
+From 86c3aa6b43e0b311c3aa5e80e58ab51ab525feb3 Mon Sep 17 00:00:00 2001
+From: CPANSec Security Scanner Bot <cpan-security@security.metacpan.org>
+Date: Thu, 13 Aug 2026 13:52:54 +0000
+Subject: [PATCH] Date::Manip: cap the length of a string handed to the parsers
+
+CVE-2026-60075.  _parse_time removes a time from anywhere in the string
+with the unanchored substitution s/$timerx/ /, where $timerx is an
+auto-generated alternation of time patterns reached through a leading
+(?:$atrx|^|\s+).  The engine retries the match at every position of an
+interior whitespace run: at each start position the leading \s+ consumes
+the rest of the run greedily, the time alternation fails because the run
+holds no digits, and the engine backtracks a space at a time across the
+run before advancing the start position.  The cost is quadratic in the
+length of the run, and no time need be present in the string.  On the
+machine this patch was tested on, parsing "x" . (" " x 2000) . "x" took
+1.7 seconds of CPU and "x" . (" " x 16000) . "x" took 107 seconds,
+rising about fourfold for each doubling of the run.
+
+Fix: reject a string longer than $MAXLENGTH (256) at the parse and
+parse_time entries, before any regex runs, which is the shape of the fix
+libwww-perl shipped in HTTP::Date 6.08 for the same weakness class.
+Legitimate date strings are well under 100 characters, and a 42 entry
+corpus of legitimate formats parses to the same value before and after.
+---
+ lib/Date/Manip/Date.pm | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/lib/Date/Manip/Date.pm b/lib/Date/Manip/Date.pm
+index b954917..f755cab 100644
+--- a/lib/Date/Manip/Date.pm
++++ b/lib/Date/Manip/Date.pm
+@@ -93,6 +93,13 @@ sub input {
+ # DATE PARSING
+ ########################################################################
+ 
++# The longest string the parsers will look at.  The time matching
++# regexp is applied unanchored, so the cost of failing to match grows
++# with the square of the length of an interior whitespace run.  Real
++# date strings are well under 100 characters.
++
++our $MAXLENGTH = 256;
++
+ sub parse {
+    my($self,$instring,@opts) = @_;
+    $self->_init();
+@@ -103,6 +110,11 @@ sub parse {
+       return 1;
+    }
+ 
++   if (length($instring) > $MAXLENGTH) {
++      $$self{'err'} = '[parse] Date string too long';
++      return 1;
++   }
++
+    my %opts     = map { $_,1 } @opts;
+ 
+    my $dmt = $$self{'tz'};
+@@ -345,6 +357,11 @@ sub parse_time {
+       return 1;
+    }
+ 
++   if (length($string) > $MAXLENGTH) {
++      $$self{'err'} = '[parse_time] Time string too long';
++      return 1;
++   }
++
+    my($y,$m,$d,$h,$mn,$s);
+ 
+    if ($$self{'err'}) {

perl-Date-Manip.spec

@@ -1,11 +1,13 @@
 Name:           perl-Date-Manip
 Version:        6.60
-Release:        3%{?dist}
+Release:        3%{?dist}.1
 Summary:        Date manipulation routines
 Group:          Development/Libraries
 License:        GPL+ or Artistic
 URL:            http://search.cpan.org/dist/Date-Manip/
 Source0:        http://www.cpan.org/authors/id/S/SB/SBECK/Date-Manip-%{version}.tar.gz
+# https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60075-r1.patch
+Patch0:         perl-Date-Manip-6.60-CVE-2026-60075.patch
 BuildArch:      noarch
 # Build
 BuildRequires:  make
@@ -60,6 +62,7 @@ with "%{_libexecdir}/%{name}/test".
 
 %prep
 %setup -q -n Date-Manip-%{version}
+%patch0 -p1
 
 # Help generators to recognize Perl scripts
 for F in t/*.t; do
@@ -100,6 +103,11 @@ make test
 %{_libexecdir}/%{name}
 
 %changelog
+* Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 6.60-3.1
+- Fix CVE-2026-60075: prevent ReDoS via crafted strings with long
+  interior whitespace runs in date/time parsing
+- Resolves: RHEL-239807
+
 * Thu Jul 20 2023 Jitka Plesnikova <jplesnik@redhat.com> - 6.60-3
 - Replace versioned MODULE_COMPAT by non-versioned perl-libs
 - Package tests