Backport the upstream CVE-2026-60075 fix from CPANSec to
perl-Date-Manip 6.60. The patch adds a $MAXLENGTH=256 constant
and length checks at the entry points of parse() and
parse_time() in lib/Date/Manip/Date.pm, rejecting overly long
input strings before any regex processing. This prevents a
Regular Expression Denial of Service (ReDoS) caused by crafted
strings with long interior whitespace runs that trigger
quadratic backtracking in the unanchored time-matching regex.
CVE: CVE-2026-60075
Upstream patches:
- https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60075-r1.patch
Resolves: RHEL-239807
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
