Loading story…
Red Hat released security updates for perl-Date-Manip to address CVE-2026-60075, an Important denial-of-service flaw in Date::Manip for Perl. The bug stems from inefficient regular-expression processing in the _parse_time function, where quadratic backtracking in an unanchored time substitution can let attackers send long whitespace-heavy strings that trigger excessive CPU consumption even when no valid time is present. Applications that pass untrusted, unbounded input to ParseDate(), Date::Manip::Date->parse(), or ->parse_time() are exposed to service degradation or loss of availability.
The fixes were issued for Red Hat Enterprise Linux 9 and 10 in advisories RHSA-2026:56970 and RHSA-2026:56971, with updated perl-Date-Manip packages 6.85-3.el9_8.1 and 6.94-5.el10_2.1 respectively, covering multiple architectures and support channels. Additional downstream and related notices indicate affected packages in Oracle Linux 10 and RHEL 8, and the weakness aligns with CWE-1333 for inefficient regular expression complexity, a class commonly associated with Regular Expression Denial of Service (ReDoS). No known public exploits were listed in the referenced advisories at publication time.
See affected versions and whether adversaries are exploiting it.
15 events from the most recent confirmed update back to the earliest known activity.
A Miracle Linux 9 security advisory identified as AXSA-2026-1643 was published for perl-date-manip to address CVE-2026-60075. The notice described the issue as a denial-of-service vulnerability with high availability impact and stated that no known exploits were available.
A Miracle Linux 8 security advisory identified as AXSA-2026-1619 was published for perl-date-manip to address CVE-2026-60075. The notice described the issue as a denial-of-service vulnerability with high availability impact and stated that no known exploits were available.
An Oracle Linux 9 security advisory identified as ELSA-2026-56970 was published for perl-date-manip to address CVE-2026-60075. The notice described the issue as availability-impacting and stated that no known exploits were available at publication time.
A Rocky Linux 8 security advisory for perl-Date-Manip, tracked in Nessus as rocky_linux_RLSA-2026-57562.nasl, addressed CVE-2026-60075. The notice described the issue as availability-impacting and stated that no known exploits were available.
An AlmaLinux 8 security advisory identified as ALSA-2026:57562 was published for perl-Date-Manip to address CVE-2026-60075 across multiple AlmaLinux 8 repositories. The notice described the issue as a denial-of-service vulnerability with high availability impact and stated that no known exploits were available.
An Oracle Linux 8 security advisory identified as ELSA-2026-57562 was published for perl-Date-Manip to address CVE-2026-60075. The notice described the issue as a denial-of-service vulnerability with high availability impact and stated that no known exploits were available.
A Rocky Linux 10 security advisory for perl-Date-Manip, tracked in Nessus as rocky_linux_RLSA-2026-56971.nasl, addressed CVE-2026-60075. The notice described the issue as having high availability impact and stated that no known exploits were available.
A Rocky Linux 9 security advisory for perl-Date-Manip, tracked in Nessus as rocky_linux_RLSA-2026-56970.nasl, addressed CVE-2026-60075. The notice described the issue as having high availability impact and stated that no known exploits were available.
A Red Hat Enterprise Linux 8 advisory, RHSA-2026:57562, was published for perl-Date-Manip to address CVE-2026-60075. The notice classified the issue as Important and recommended updating affected packages.
An AlmaLinux 9 security advisory identified as ALSA-2026:56970 was published for perl-Date-Manip to address CVE-2026-60075 across multiple AlmaLinux 9 repositories. The notice described the issue as a denial-of-service vulnerability with high availability impact and stated that no known exploits were available.
An AlmaLinux 10 security advisory identified as ALSA-2026:56971 was published for perl-Date-Manip to address CVE-2026-60075 across multiple AlmaLinux 10 repositories. The notice described the issue as a denial-of-service vulnerability with high availability impact and stated that no known exploits were available.
An Oracle Linux 10 security advisory identified as ELSA-2026-56971 was published for perl-date-manip, covering CVE-2026-60075. The notice described the issue as availability-impacting and stated that no known exploits were available at publication time.
Red Hat published advisory RHSA-2026:56971 for Red Hat Enterprise Linux 10, rating the issue Important and releasing perl-Date-Manip-6.94-5.el10_2.1 to fix the vulnerability. The update covers multiple RHEL 10 variants, architectures, and lifecycle channels.
Red Hat published advisory RHSA-2026:56970 for Red Hat Enterprise Linux 9, rating the issue Important and releasing perl-Date-Manip-6.85-3.el9_8.1 to remediate the denial-of-service flaw. The advisory applies across multiple RHEL 9 architectures and support channels.
The vulnerability CVE-2026-60075 was published as a denial-of-service issue in Date::Manip for Perl caused by CPU exhaustion during date parsing. Later advisories and plugin entries reference this publication date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
16 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for Node.js packages across **RHEL 8, 9, and 10** to fix three denial-of-service vulnerabilities in bundled components: `CVE-2026-13149` in **brace-expansion**, `CVE-2026-59873` in **node-tar**, and `CVE-2026-59874` in **node-tar/tar**. The advisories cover multiple product streams, including `nodejs:24` on RHEL 8 and 9, `nodejs22` and `nodejs24` on RHEL 10, and `nodejs:22` for RHEL 9.6 Extended Update Support, with updated packages such as Node.js 22.23.1 and 24.18.0 distributed across standard, EUS, and ELC channels. The flaws could let attackers trigger excessive resource consumption through crafted input during archive handling or pattern expansion. In **brace-expansion**, consecutive non-expanding `{}` groups can drive exponential-time processing and block the event loop; in **node-tar**, a crafted gzip bomb can exhaust CPU and disk during extraction or parsing, while a malformed tar header with a negative base-256 entry size can cause the scanner to repeatedly parse the same header without making progress. Red Hat tracked the issues in Bugzilla and published remediation through advisories including `RHSA-2026:47060`, `RHSA-2026:47057`, `RHSA-2026:48033`, `RHSA-2026:48034`, `RHSA-2026:52399`, and `RHSA-2026:53298`.
Aug 23, 2026
Red Hat released Important security updates for BIND addressing **CVE-2024-1975** and **CVE-2024-1737**, denial-of-service flaws affecting DNS resolvers and authoritative servers. CVE-2024-1975 allows clients to exhaust CPU resources with streams of SIG(0)-signed requests when a server hosts a `KEY` record or a validating resolver has cached one. CVE-2024-1737 causes severe database and query-performance degradation when a single hostname contains very large numbers of resource records. Affected upstream BIND releases include 9.11 through 9.11.37, 9.16 through 9.16.50, 9.18 through 9.18.27, and 9.19 through 9.19.24, with CVE-2024-1975 also affecting releases from 9.0.0 onward. The fixes are available across supported RHEL 8 and RHEL 9 update channels and OpenShift Container Platform 4.12 through 4.16. Red Hat advisories provide updated packages including `9.11.36-16.el8_10.2` for RHEL 8, `9.11.36-8.el8_8.6` for RHEL 8.8 channels, and `9.16.23-11.el9_2.5` for RHEL 9.2; selected RHEL 8.6 and RHEL 9.2 channels also remediate **CVE-2024-4076**, an assertion-failure condition when serving stale cache data and authoritative-zone content. Organizations should apply the applicable BIND updates promptly, prioritizing exposed recursive resolvers and authoritative DNS infrastructure.
Aug 27, 2026
Red Hat released **Important** security updates for OpenSSL across multiple **RHEL 9** and **RHEL 10** channels to address two high-impact vulnerabilities, **`CVE-2025-15467`** and **`CVE-2025-69419`**. The first flaw affects parsing of CMS `AuthEnvelopedData` with AEAD ciphers, where an oversized initialization vector can overflow a fixed-size stack buffer before authentication or tag verification, creating a path to denial of service and possible remote code execution. The second flaw is a memory corruption bug in PKCS#12 processing, where `BMPString` to UTF-8 conversion can trigger an out-of-bounds heap write when an application parses an attacker-controlled PKCS#12 file, potentially causing a crash or arbitrary code execution. Upstream fixes were issued in OpenSSL **3.0.19**, **3.3.6**, **3.4.4**, **3.5.5**, **3.6.1**, and **1.1.1ze** for the affected branches, while OpenSSL **1.0.2** is not affected and the OpenSSL FIPS modules are outside the vulnerable code paths. Red Hat advisories including **RHSA-2026:1496**, **RHSA-2026:1503**, **RHSA-2026:1519**, **RHSA-2026:1594**, and **RHSA-2026:1733** cover impacted products such as RHEL 9.0, 9.2, 9.4, 9.6, and 10.0 variants, along with related SAP, AUS, EUS, OpenShift, and JBoss Core Services offerings, with updated package builds released for major architectures including `x86_64`, `aarch64`, `ppc64le`, and `s390x`.
Aug 20, 2026