high · CVSS v3 7.5
CVE-2026-82560
CVE-2026-82560 causes CPU and memory exhaustion in Perl's Pod::Text when processing deeply nested =over directives. The vulnerability leads
Overview
CVE-2026-82560 causes CPU and memory exhaustion in Perl's Pod::Text when processing deeply nested =over directives. The vulnerability leads to denial of service by exhausting system resources. It affects all installations using Pod::Text prior to version 6.1.1.
Description
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.
Impact
The flaw results in a denial of service, compromising availability. Attackers can trigger the issue by supplying crafted POD documents. Defenders must monitor for abnormal CPU/memory usage and ensure that Pod::Text is not exposed to untrusted input.
Remediation
Upgrade Pod::Text to version 6.1.1 or later. If upgrade is not possible, restrict input size, enforce resource limits, or sandbox the formatting process. Apply any vendor patches promptly.
Risk context
Severity is high with a CVSS v3 score of 7.5. The lack of EPSS data suggests a moderate but still significant risk; defenders should act promptly.
Affected products
- Perl Pod::Text <6.1.1
Scores
- Severity
- high
- CVSS v2
- 5
- CVSS v3
- 7.5
- CVSS v4
- —
- EPSS
- —