CVE-2026-82560 Details
Description
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.
A denial-of-service vulnerability has been identified in Pod::Text versions prior to 6.1.1 for Perl. The issue arises when formatting a POD document with excessive =over nesting, which can cause CPU and memory exhaustion. Each =over command adds indentation to the margin, reducing the available output width for text. When the width reaches zero, the line-wrapping function enters an infinite loop, continuously adding margin padding without processing any actual content. This flaw can be exploited by supplying a specially crafted POD document that takes advantage of the nesting, leading to unreturned formatting operations and excessive memory consumption.
Users are advised to upgrade to Pod::Text version 6.1.1 or later, which addresses the vulnerability by handling margins that exceed the output width. Instructions for upgrading can be found on the Pod::Text MetaCPAN page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 19, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261 | CPANSec | Source Code |
| https://metacpan.org/release/RRA/podlators-v6.1.1/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/09/19/6 | CVE | AdvisoryMailing ListRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Pod::Text | < 6.1.1 (semver) |
CPE
Remediation
| |
| Perl | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 19, 2026 | CVE Modified | CVE |
| Sep 19, 2026 | New CVE Received | CPANSec |