CVE-2026-14741: HTTP::Date for Perl DoS Vulnerability

CVE-2026-14741 Overview

CVE-2026-14741 is a regular expression denial of service (ReDoS) vulnerability in the Perl HTTP::Date module before version 6.08. The flaw resides in parse_date(), which chains alternative regexes containing adjacent unbounded quantifiers before a trailing \s*$ anchor. A crafted date string triggers polynomial (approximately quadratic) backtracking in the regex engine. Because str2time() delegates to parse_date(), any caller that parses untrusted Date, Expires, or Last-Modified headers can be forced to consume unbounded CPU. A header value of a few tens of kilobytes runs for tens of seconds of CPU time, producing a denial of service condition.

Critical Impact
Remote unauthenticated attackers can exhaust CPU resources on any Perl service that parses HTTP date headers through HTTP::Date, causing denial of service.

Affected Products

Perl HTTP::Date module versions prior to 6.08
Applications and libraries built on libwww-perl that call parse_date() or str2time() with untrusted input
Perl-based HTTP clients, proxies, and servers processing Date, Expires, or Last-Modified headers

Discovery Timeline

2026-07-17 - CVE-2026-14741 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-14741

Vulnerability Analysis

The vulnerability is classified under [CWE-1333] Inefficient Regular Expression Complexity. HTTP::Date::parse_date() attempts to recognize timestamps by matching an input against a sequence of alternative regex patterns. Several of these patterns place two or more unbounded quantifiers (such as \d+, \w+, or \s+) directly adjacent to each other, terminated by \s*$.

When the input contains a valid date-like prefix followed by a long homogeneous run of digits, letters, or whitespace and a single trailing byte that prevents the anchor from matching, the regex engine repartitions the run across the adjacent quantifiers. The number of partitions grows quadratically with the length of the run. Because str2time() calls parse_date() internally, both entry points are affected.

Root Cause

The root cause is ambiguous quantifier composition in the alternation patterns inside parse_date(). Adjacent unbounded quantifiers with overlapping character classes create exponential match ambiguity that the Perl regex engine resolves through backtracking. No length cap existed on the input before matching, so any caller could pass arbitrarily long strings directly to the vulnerable patterns.

Attack Vector

Exploitation requires only network access to a service that reads HTTP headers through HTTP::Date. An attacker sends an HTTP response or request containing an oversized Date, Expires, or Last-Modified header value. The header is parsed by str2time() or parse_date(), and the Perl interpreter blocks on regex backtracking for tens of seconds per request, consuming a CPU core.

text

// Security patch entry in Changes (HTTP-Date 6.08)
    - [SECURITY] Reject input longer than 64 characters in parse_date()
      to prevent quadratic regex backtracking (a denial of service) on
      hostile date strings. Fixes CVE-2026-14741. (Olaf Alders)

 6.07      2026-06-25 15:12:09Z

Source: GitHub Patch for HTTP-Date

The fix rejects any input to parse_date() longer than 64 characters, eliminating the quadratic backtracking condition before the regex engine engages.

Detection Methods for CVE-2026-14741

Indicators of Compromise

Sustained high CPU usage in Perl worker processes correlated with inbound HTTP requests or responses containing oversized date headers
HTTP requests or responses carrying Date, Expires, or Last-Modified header values exceeding a few kilobytes
Request timeouts or worker pool exhaustion on Perl-based HTTP services with no corresponding traffic spike in request volume

Detection Strategies

Inventory Perl deployments and identify installed versions of HTTP::Date, flagging any release earlier than 6.08
Monitor upstream and downstream HTTP header sizes at the reverse proxy or WAF layer, alerting on abnormally long date header values
Instrument Perl services to log slow parse_date() or str2time() invocations and correlate with source IP

Monitoring Recommendations

Track per-process CPU time and request latency on Perl HTTP endpoints and alert on sustained outliers
Log and rate-limit clients that send HTTP headers exceeding reasonable size thresholds
Correlate WAF header-length alerts with backend Perl process telemetry to identify targeted ReDoS attempts

How to Mitigate CVE-2026-14741

Immediate Actions Required

Upgrade HTTP::Date to version 6.08 or later on all systems using libwww-perl or dependent modules
Audit application code for direct callers of parse_date() and str2time() that accept untrusted input
Enforce HTTP header size limits at reverse proxies, load balancers, or WAFs in front of Perl services

Patch Information

The fix is available in HTTP::Date 6.08, published on MetaCPAN. The patch is applied in commit 78c20952 via Pull Request #33. The change rejects input longer than 64 characters in parse_date(), which is sufficient to bound the regex engine's work. See the OpenWall OSS-Security discussion for coordination details.

Workarounds

Truncate or reject HTTP date header values longer than 64 characters before passing them to HTTP::Date
Wrap calls to parse_date() and str2time() with a length guard until the upgrade to 6.08 is deployed
Apply per-request CPU timeouts on Perl workers to bound the impact of any ReDoS attempt

bash

# Upgrade HTTP::Date to the patched release
cpanm HTTP::Date@6.08

# Verify installed version
perl -MHTTP::Date -e 'print $HTTP::Date::VERSION, "\n"'