CVE-2026-60075 Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time

[
  {
    "collectionURL": "https://cpan.org/modules",
    "defaultStatus": "unaffected",
    "packageName": "Date-Manip",
    "product": "Date::Manip",
    "programFiles": [
      "lib/Date/Manip/Date.pm"
    ],
    "programRoutines": [
      {
        "name": "Date::Manip::Date::_parse_time"
      },
      {
        "name": "Date::Manip::Date::_other_rx"
      },
      {
        "name": "Date::Manip::Date::parse"
      },
      {
        "name": "Date::Manip::Date::parse_time"
      },
      {
        "name": "Date::Manip::DM6::ParseDate"
      }
    ],
    "repo": "https://github.com/SBECK-github/Date-Manip",
    "vendor": "SBECK",
    "versions": [
      {
        "lessThanOrEqual": "6.99",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]