SZB-eccb0b9330
DateTime::Lite can be driven to CPU exhaustion when adding seconds (EUVD-2026-113902)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- DateTime::Lite
- Product
- DateTime::Lite
- First seen
Summary
The EUVD entry, as relayed on Mastodon, says DateTime::Lite versions before 0.8.1 allow CPU exhaustion because leap-second normalization loops one day at a time. The item lists no score.
If you use DateTime::Lite
Upgrade DateTime::Lite to version 0.8.1 or later.
Validate or bound user-supplied second values passed to add().
What the sources say 1
· Mastodon: “DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds.” Source