DateTime::Lite before 0.8.1 allows CPU exhaustion (CVE-2026-87768)
Original title: CVE-2026-87768: DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds
Adding seconds can trigger a per-day loop in the Perl module; 0.8.1 is the fixed version named in the notice.
An oss-security post by Robert Rothenberg on October 30 reports CVE-2026-87768 in DateTime::Lite for Perl. Versions before 0.8.1 can exhaust CPU through a per-day loop when seconds are added. The notice points to the DateTime-Lite distribution on MetaCPAN. The available text does not describe exploitation or a workaround beyond the fixed release.
Unconfirmed: Only a feed snippet was available, so further technical detail from the full post is not confirmed here.
- Affected releases are DateTime::Lite versions before 0.8.1.
- The stated impact is CPU exhaustion, not code execution.
- The posting links to the MetaCPAN DateTime-Lite distribution.
Impact: CPU exhaustion when adding seconds
| Product | Affected | Fixed in |
|---|---|---|
| DateTime-Lite DateTime::Lite | before 0.8.1 | 0.8.1 |
- 1.Upgrade DateTime::Lite to 0.8.1.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87768 | CPU exhaustion in DateTime::Lite before 0.8.1 | 7.5 | — |
From the original article
Posted by Robert Rothenberg on Oct 30 ======================================================================== https://metacpan. org/dist/DateTime-Lite VCS Repo: ...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.