HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date. parse_date() matches the date string against a chain of alternative regexes, and str2time() delegates to it. Several of these patterns place unbounded quantifiers next to each other before a trailing `\s*$` anchor. A valid date prefix followed by a long interior run of digits, letters, or whitespace and a single trailing byte that defeats the final match forces the engine to repartition the run, giving polynomial (about quadratic) backtracking. A header value of a few tens of kilobytes runs for tens of seconds of CPU. HTTP::Date parses timestamps such as HTTP `Date`, `Expires`, and `Last-Modified` headers, which commonly originate from untrusted sources. Any caller that passes an untrusted date header to str2time() or parse_date() can be driven to consume unbounded CPU, a denial of service.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3454-1 advisory.

    This update for perl-HTTP-Date fixes the following issue

    - CVE-2026-14741: CPU exhaustion due to polynomial regex backtracking in `parse_date` when processing     specially crafted       date strings (bsc#1271705).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b1bdb7c518 advisory.

    Changes:

    6.08      2026-07-09 02:04:21Z

        - [SECURITY] Reject input longer than 64 characters in parse_date()           to prevent quadratic regex backtracking (a denial of service) on           hostile date strings. Fixes CVE-2026-14741. (Olaf Alders)

    6.07      2026-06-25 15:12:09Z

        - Add test with Time::Zone (GH#25) (Michal Josef paek)
        - Add test with bad Time::Zone string (GH#26) (Michal Josef paek)
        - Add tests with negative time (GH#26) (Michal Josef paek)
        - Replace all instances of \d with [0-9] in regular expressions to           reject non-ASCII Unicode digits, with a regression test (GH#27)           (Robert Rothenberg)
        - Reject malformed ISO 8601 timezones with a doubled colon (GH#31)           (Olaf Alders)
        - Document day/month/year ordering for numeric dates (GH#32) (Olaf           Alders)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3334-1 advisory.

    This update for perl-HTTP-Date fixes the following issue:

    - CVE-2026-14741: CPU exhaustion due to polynomial regex backtracking in `parse_date` when processing     specially crafted       date strings (bsc#1271705).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:22859-1 advisory.

    This update for perl-HTTP-Date fixes the following issue

    - CVE-2026-14741: CPU exhaustion via polynomial regex backtracking in parse_date (bsc#1271705).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21427-1 advisory.

    This update for perl-HTTP-Date fixes the following issue

    - CVE-2026-14741: CPU exhaustion via polynomial regex backtracking in parse_date (bsc#1271705).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8cec3cbf5b advisory.

    Changes:

    6.08      2026-07-09 02:04:21Z

        - [SECURITY] Reject input longer than 64 characters in parse_date()           to prevent quadratic regex backtracking (a denial of service) on           hostile date strings. Fixes CVE-2026-14741. (Olaf Alders)

    6.07      2026-06-25 15:12:09Z

        - Add test with Time::Zone (GH#25) (Michal Josef paek)
        - Add test with bad Time::Zone string (GH#26) (Michal Josef paek)
        - Add tests with negative time (GH#26) (Michal Josef paek)
        - Replace all instances of \d with [0-9] in regular expressions to           reject non-ASCII Unicode digits, with a regression test (GH#27)           (Robert Rothenberg)
        - Reject malformed ISO 8601 timezones with a doubled colon (GH#31)           (Olaf Alders)
        - Document day/month/year ordering for numeric dates (GH#32) (Olaf           Alders)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in     parse_date. parse_date() matches the date string against a chain of alternative regexes, and str2time()     delegates to it. Several of these patterns place unbounded quantifiers next to each other before a     trailing `\s*$` anchor. A valid date prefix followed by a long interior run of digits, letters, or     whitespace and a single trailing byte that defeats the final match forces the engine to repartition the     run, giving polynomial (about quadratic) backtracking. A header value of a few tens of kilobytes runs for     tens of seconds of CPU. HTTP::Date parses timestamps such as HTTP `Date`, `Expires`, and `Last-Modified`     headers, which commonly originate from untrusted sources. Any caller that passes an untrusted date header     to str2time() or parse_date() can be driven to consume unbounded CPU, a denial of service.
    (CVE-2026-14741)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
331844	SUSE SLED15 / SLES15 Security Update : perl-HTTP-Date (SUSE-SU-2026:3454-1)	Nessus	SuSE Local Security Checks	high
330764	Fedora 43 : perl-HTTP-Date (2026-b1bdb7c518)	Nessus	Fedora Local Security Checks	high
330552	SUSE SLES12 Security Update : perl-HTTP-Date (SUSE-SU-2026:3334-1)	Nessus	SuSE Local Security Checks	high
330285	SUSE SLES16 Security Update : perl-HTTP-Date (SUSE-SU-2026:22859-1)	Nessus	SuSE Local Security Checks	high
329725	openSUSE 16 Security Update : perl-HTTP-Date (openSUSE-SU-2026:21427-1)	Nessus	SuSE Local Security Checks	high
327483	Fedora 44 : perl-HTTP-Date (2026-8cec3cbf5b)	Nessus	Fedora Local Security Checks	high
326084	Linux Distros Unpatched Vulnerability : CVE-2026-14741	Nessus	Misc.	high

Detections

Analytics

CVE-2026-14741

high

Tenable Plugins

high

high

high

high

high

high

high