Read the docs
TI-2026-83045 Aliases CVE-2026-87768GHSA-4rjq-xvjh-92j2

Inefficient day loop in DateTime::Lite for Perl enables CPU exhaustion

Priority LOW 39CWE-407Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-407.

Summary

DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds. The _normalize_leap_seconds routine crosses day boundaries one day at a time, so adding a large number of seconds to an object with a non-floating time zone takes about |$n|/86400 iterations, and nothing limits that number. An attacker who controls the number of seconds added can keep the process busy for as long as they choose. The flaw is classified as CWE-407 (Inefficient Algorithmic Complexity) and has a CVSS 3.1 base score of 7.5.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds. _normalize_leap_seconds crosses day boundaries one day at a time, so add(seconds => $n) on an object with a non-floating time zone takes about |$n|/86400 iterations, and nothing limits $n. The XS implementation and the pure-Perl fallback both have the loop. An attacker who controls the number of seconds added can keep the process busy for as long as they choose.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00424 36th percentileScored 2026-11-07
Fix Fixed DateTime-Lite: 0.8.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—DateTime-Litebefore 0.8.10.8.1Patch availableCNA
  • DateTime-Lite Vendor— Affected before 0.8.1 Fixed in 0.8.1 Patch available CNA

Remediation

Upgrade DateTime-Lite to version 0.8.1 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA DateTime-Lite Fixed in 0.8.1

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-87768
  2. 2026-10-30 Alias added: GHSA-4rjq-xvjh-92j2
  3. 2026-11-06 CVSS score added · CISA ADP
  4. 2026-11-06 CISA SSVC decision points changed

References

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences