A denial of service vulnerability in OALDERS HTTP::Date for Perl allows unauthenticated attackers to cause severe CPU exhaustion through polynomial regex backtracking.

This issue is an inefficient regular expression complexity flaw (CWE-1333) located in the parse_date function, where unauthenticated attackers can supply crafted date headers that trigger excessive CPU consumption.

Successful exploitation of this vulnerability can lead to significant system downtime and service disruption for applications processing untrusted HTTP date headers. Because the attack vector is network-based and requires no privileges or user interaction, external actors can easily target dependent web services. The CVSS score of 7.5 reflects a high severity level due to the potential for complete application denial of service.

Immediate Action: Upgrade to HTTP::Date version 6.08 or later, which introduces input length restrictions to prevent regex backtracking.

Proactive Monitoring: Monitor system resource utilization, specifically CPU spikes and prolonged response times associated with HTTP header processing.

Compensating Controls: Implement input size validation at the web server or proxy layer to drop excessively long header values before they reach the Perl application.

Public Exploit Available: unknown

Administrators managing Perl applications utilizing HTTP::Date must prioritize updating the library to version 6.08 or later to mitigate the risk of denial of service attacks. Applying this update immediately ensures that unbounded input strings are properly rejected before triggering resource-intensive regular expression evaluations.