CVE-2026-87768 Details
Description
DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds. _normalize_leap_seconds crosses day boundaries one day at a time, so add(seconds => $n) on an object with a non-floating time zone takes about |$n|/86400 iterations, and nothing limits $n. The XS implementation and the pure-Perl fallback both have the loop. An attacker who controls the number of seconds added can keep the process busy for as long as they choose.
A denial-of-service vulnerability has been identified in DateTime::Lite versions prior to 0.8.1 for Perl. The issue arises from the _normalize_leap_seconds function, which, when adding seconds, crosses day boundaries one day at a time. This means that adding a large number of seconds to an object with a non-floating time zone can cause the process to iterate approximately |$n|/86400 times, where $n is the number of seconds added. There is no limit on the value of $n, allowing an attacker to exhaust CPU resources by controlling the number of seconds added.
Users are advised to upgrade to DateTime::Lite version 0.8.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/JDEGUEST/DateTime-Lite-v0.8.1/changes | CPANSec | Source CodeVendor |
| http://www.openwall.com/lists/oss-security/2026/10/30/10 | CVE | AdvisoryMailing ListRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-407 | Inefficient Algorithmic Complexity | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| DateTime::Lite | < 0.8.1 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | CVE Modified | CVE |
| Oct 30, 2026 | New CVE Received | CPANSec |