CVE-2026-87768

{"id": "CVE-2026-87768", "cveTags": [], "metrics": {}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://gitlab.com/deguest/DateTime-Lite", "modules": ["DateTime::Lite"], "versions": [{"status": "affected", "version": "0", "lessThan": "0.8.1", "versionType": "custom"}], "packageURL": "pkg:cpan/DateTime-Lite", "packageName": "DateTime-Lite", "programFiles": ["DateTime-Lite.xs", "lib/DateTime/Lite/PP.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "DateTime::Lite::_normalize_leap_seconds"}, {"name": "DateTime::Lite::add"}]}]}], "published": "2026-10-30T13:20:15.910", "references": [{"url": "https://metacpan.org/release/JDEGUEST/DateTime-Lite-v0.8.1/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/30/10", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-407"}]}], "descriptions": [{"lang": "en", "value": "DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds.\n\n_normalize_leap_seconds crosses day boundaries one day at a time, so add(seconds => $n) on an object with a non-floating time zone takes about |$n|/86400 iterations, and nothing limits $n. The XS implementation and the pure-Perl fallback both have the loop.\n\nAn attacker who controls the number of seconds added can keep the process busy for as long as they choose."}], "lastModified": "2026-10-30T19:39:14.897", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}