CVE-2026-14741 HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date
Attackers can cause CPU exhaustion and denial of service by sending crafted HTTP date headers to applications using the vulnerable Perl library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-14741?
CVE-2026-14741 is a high-severity denial of service vulnerability in OALDERS HTTP::Date, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date.
parse_date() matches the date string against a chain of alternative regexes, and str2time() delegates to it. Several of these patterns place unbounded quantifiers next to each other before a trailing `\s*$` anchor. A valid date prefix followed by a long interior run of digits, letters, or whitespace and a single trailing byte that defeats the final match forces the engine to repartition the run, giving polynomial (about quadratic) backtracking. A header value of a few tens of kilobytes runs for tens of seconds of CPU.
HTTP::Date parses timestamps such as HTTP `Date`, `Expires`, and `Last-Modified` headers, which commonly originate from untrusted sources. Any caller that passes an untrusted date header to str2time() or parse_date() can be driven to consume unbounded CPU, a denial of service.
Weakness: CWE-1333
Which versions are affected by CVE-2026-14741?
Linux distribution packages (6)
perl-HTTP-Date SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 6.02-150000.3.3.1 |
perl-HTTP-Date SUSE:Linux Enterprise Server 16.0 | All versions | 6.06-160000.3.1 |
perl-HTTP-Date SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 6.02-9.3.1 |
perl-HTTP-Date SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 6.06-160000.3.1 |
perl-HTTP-Date openSUSE:Leap 16.0 | All versions | 6.06-160000.3.1 |
perl-HTTP-Date openSUSE:Tumbleweed | All versions | 6.80.0-1.1 |
How do I fix CVE-2026-14741?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-14741 being exploited?
There is no known exploitation of CVE-2026-14741 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-14741, DEBIAN-CVE-2026-14741, ECHO-2e88-4656-82f2, GHSA-mcqf-9rr5-v7rw, MGASA-2026-0362, ROOT-OS-DEBIAN-12-CVE-2026-14741 and 8 more.