{"id":"CVE-2026-87768","state":"PUBLISHED","title":"DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds","description":"DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds.\n\n_normalize_leap_seconds crosses day boundaries one day at a time, so add(seconds => $n) on an object with a non-floating time zone takes about |$n|/86400 iterations, and nothing limits $n. The XS implementation and the pure-Perl fallback both have the loop.\n\nAn attacker who controls the number of seconds added can keep the process busy for as long as they choose.","publishedAt":"2026-10-30T12:25:21.054Z","updatedAt":"2026-10-30T15:05:30.618Z","severity":null,"assigner":"CPANSec","products":["DateTime-Lite"],"affected":[{"packageName":"DateTime-Lite","packageURL":"pkg:cpan/DateTime-Lite","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"0.8.1","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","modules":["DateTime::Lite"],"programFiles":["DateTime-Lite.xs","lib/DateTime/Lite/PP.pm"],"programRoutines":[{"name":"DateTime::Lite::_normalize_leap_seconds"},{"name":"DateTime::Lite::add"}],"repo":"https://gitlab.com/deguest/DateTime-Lite"}],"references":["https://metacpan.org/release/JDEGUEST/DateTime-Lite-v0.8.1/changes","http://www.openwall.com/lists/oss-security/2026/10/30/10"],"weaknesses":["CWE-407"],"ingestedAt":"2026-10-30T15:18:06.520Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/87xxx/CVE-2026-87768.json","commit":"70fdf27998a84c5869ef58058ee273012c4794a3","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-87768","state":"PUBLISHED","datePublished":"2026-10-30T12:25:21.054Z","dateUpdated":"2026-10-30T15:05:30.618Z","assignerShortName":"CPANSec","assignerOrgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateReserved":"2026-09-09T08:09:07.714Z"},"containers":{"cna":{"title":"DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds","descriptions":[{"lang":"en","value":"DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds.\n\n_normalize_leap_seconds crosses day boundaries one day at a time, so add(seconds => $n) on an object with a non-floating time zone takes about |$n|/86400 iterations, and nothing limits $n. The XS implementation and the pure-Perl fallback both have the loop.\n\nAn attacker who controls the number of seconds added can keep the process busy for as long as they choose."}],"affected":[{"packageName":"DateTime-Lite","packageURL":"pkg:cpan/DateTime-Lite","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"0.8.1","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","modules":["DateTime::Lite"],"programFiles":["DateTime-Lite.xs","lib/DateTime/Lite/PP.pm"],"programRoutines":[{"name":"DateTime::Lite::_normalize_leap_seconds"},{"name":"DateTime::Lite::add"}],"repo":"https://gitlab.com/deguest/DateTime-Lite"}],"references":[{"url":"https://metacpan.org/release/JDEGUEST/DateTime-Lite-v0.8.1/changes","tags":["release-notes"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-407","description":"CWE-407 Inefficient Algorithmic Complexity","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CPANSec","orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateUpdated":"2026-10-30T12:25:21.054Z"},"solutions":[{"lang":"en","value":"Upgrade to DateTime-Lite v0.8.1 or later."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"cpansec-cna-tool 0.1"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/10"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-10-30T15:05:30.618Z"}}]}}}