Perl parse_date ReDoS Vulnerability (CVE-2026-14741): PoC and Fix for DoS

Vulnerability Overview This vulnerability involves a potential Denial of Service (DoS) attack caused by greedy matching and backtracking issues in the regular expression used for date parsing. Specifically, when the input string exceeds 64 characters, the parser attempts extensive backtracking operations, consuming significant CPU resources and rendering the service unavailable. Affected Scope Affected Module: function Affected Versions: Not explicitly specified, but the patch mentions fixing CVE-2026-14741 Attack Conditions: Input string length exceeds 64 characters Remediation 1. Add Length Check: Before parsing the date, check the length of the input string. If it exceeds 64 characters, reject it immediately. 2. Optimize Regular Expression: Ensure the regular expression does not cause excessive backtracking with long inputs. 3. Add Test Cases: Add test cases to verify the effectiveness of the fix, ensuring that long input strings are correctly rejected. POC Code Below is the code for the patched function: ```perl sub parse_date ($) { my $s = shift; return unless defined; Reject over-long input up front, before any regex runs, so hostile strings cannot drive the parsing regexes into pathological backtracking. Length is measured as given (leading/trailing whitespace included). This cap is a security limit, not a tunable: every format we accept is far shorter, and the parsing regexes still contain adjacent unbounded quantifiers, so raising it demands re-benchmarking against hostile input. return if length($s) > 64; More lax parsing below s/^\s+//; kill leading space s/^\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3})\s([A-Za-z]{3

Goal Reached Thanks to every supporter — we hit 100%!

Perl parse_date ReDoS Vulnerability (CVE-2026-14741): PoC and Fix for DoS

More from this source