CVE-2026-14741: HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date
HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libhttp-date-perlto a version that resolves this vulnerability.Fixed in 6.08-1 - Upgrade
Upgrade
HTTP::Date (Perl)to a version that resolves this vulnerability.Fixed in 6.08Patch CVE-2026-14741
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14741?
CVE-2026-14741 has a risk score of 30, indicating a moderate level of impact.
How do I fix CVE-2026-14741?
To fix CVE-2026-14741, update the HTTP::Date module to version 6.08 or later.
What is the impact of CVE-2026-14741?
CVE-2026-14741 can lead to CPU exhaustion due to inefficient regex processing in the parse_date function.
Which versions are affected by CVE-2026-14741?
CVE-2026-14741 affects all versions of HTTP::Date prior to 6.08 for Perl.
What specific function is vulnerable in CVE-2026-14741?
The parse_date function in HTTP::Date is vulnerable due to polynomial regex backtracking.