Log in Start free

Vulnerability · Published Sep 19, 2026 · Assigned by CPANSec

CVE-2026-82560Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width

High 7.5

In plain English

A high-severity infinite loop in perl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 49.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12perlno fix listedDEBIAN-CVE-2026-82560
Debian:13perlno fix listedDEBIAN-CVE-2026-82560
Debian:14perlno fix listedDEBIAN-CVE-2026-82560
Ubuntu:22.04:LTSperlno fix listedUBUNTU-CVE-2026-82560
Ubuntu:24.04:LTSperlno fix listedUBUNTU-CVE-2026-82560
Ubuntu:26.04:LTSperlno fix listedUBUNTU-CVE-2026-82560
Ubuntu:26.10perlno fix listedUBUNTU-CVE-2026-82560

Affected products (as reported)

VendorProductVersions
podlators 0 – before 6.1.1
perl 0 – through 5.45.2

Weakness: CWE-835 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References