{"id":"CVE-2026-82560","summary":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width","details":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.","modified":"2026-09-20T11:45:14.600942891Z","published":"2026-09-19T15:15:52.620Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82560.json","cna_assigner":"CPANSec","cwe_ids":["CWE-835"]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/09/19/6"},{"type":"WEB","url":"https://cpan.org/modules"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82560.json"},{"type":"PACKAGE","url":"https://github.com/Perl/perl5"},{"type":"PACKAGE","url":"https://github.com/rra/podlators"},{"type":"FIX","url":"https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch"},{"type":"WEB","url":"https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261"},{"type":"ADVISORY","url":"https://metacpan.org/release/RRA/podlators-v6.1.1/changes"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/perl/perl5","events":[{"introduced":"0"},{"last_affected":"6f488b9e12b015c5b1b2827a5621991e8bd30e04"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"5.45.2"}],"source":"AFFECTED_FIELD"}}],"versions":["v5.45.2","v5.45.0","v5.44.0","v5.44.0-RC2","v5.44.0-RC1","v5.43.11","v5.43.10","v5.43.9","v5.43.8","v5.42.0","v5.43.6","v5.43.2","v5.43.1","v5.43.0","v5.42.0-RC3","v5.42.0-RC2","v5.42.0-RC1","v5.41.13","v5.41.12","v5.41.11","v5.41.10","v5.41.9","v5.41.8","v5.41.7","v5.41.5","v5.41.4","v5.41.3","v5.40.0","v5.41.2","v5.41.1","v5.41.0","v5.40.0-RC2","v5.40.0-RC1","v5.39.8","v5.39.7","v5.39.5","v5.39.4","v5.38.0","v5.39.3","v5.39.1","v5.39.0","v5.38.0-RC2","v5.38.0-RC1","v5.37.11","v5.37.10","v5.37.9","v5.37.7","v5.37.6","v5.37.5","v5.37.4","v5.37.3","v5.37.2","v5.37.1","v5.36.0","v5.37.0","v5.36.0-RC3","v5.35.11","v5.35.10","v5.34.0","v5.35.9","v5.35.8","v5.35.6","v5.35.5","v5.35.3","v5.35.0","v5.34.0-RC2","v5.34.0-RC1","v5.33.9","v5.33.8","v5.33.7","v5.32.0","v5.33.4","v5.33.3","v5.33.2","v5.33.1","v5.33.0","v5.32.0-RC1","v5.31.11","v5.31.7","v5.31.5","v5.30.0","v5.31.4","v5.31.3","v5.31.2","v5.31.1","v5.31.0","v5.30.0-RC2","v5.30.0-RC1","v5.29.10","v5.29.9","v5.29.8","v5.29.7","v5.29.6","v5.29.5","v5.28.0","v5.29.1","v5.29.0","v5.28.0-RC4","v5.28.0-RC3","v5.28.0-RC2","v5.28.0-RC1","v5.27.11","v5.27.10","v5.27.8","v5.27.7","v5.27.6","v5.27.5","v5.27.3","v5.26.0","v5.27.0","v5.26.0-RC2","v5.25.11","v5.25.9","v5.25.7","v5.25.5","v5.25.4","v5.25.3","v5.24.0","v5.25.2","v5.25.0","v5.24.0-RC5","v5.24.0-RC4","v5.24.0-RC3","v5.24.0-RC2","v5.24.0-RC1","v5.23.7","v5.23.6","v5.23.4","v5.23.3","if-0.0605","v5.23.2","v5.23.1","v5.23.0","v5.22.0","v5.22.0-RC2","v5.22.0-RC1","v5.21.11","if-0.0604","v5.21.10","v5.21.9","v5.21.8","v5.21.6","v5.21.5","v5.21.4","v5.21.1","v5.21.0","v5.20.0","v5.20.0-RC1","v5.19.11","v5.19.7","v5.19.5","v5.19.3","v5.19.2","if-0.0603","v5.19.1","v5.18.0","v5.19.0","v5.18.0-RC4","v5.18.0-RC3","v5.18.0-RC2","v5.18.0-RC1","v5.17.9","v5.17.8","v5.17.7.0","v5.17.7","v5.17.6","v5.17.4","v5.17.2","v5.17.0","v5.16.0","v5.16.0-RC2","v5.16.0-RC1","v5.15.9","v5.15.5","v5.15.4","v5.15.3","v5.15.2","v5.15.1","v5.15.0","v5.14.0","v5.14.0-RC3","v5.14.0-RC2","v5.14.0-RC1","v5.13.11","v5.13.10","v5.13.9","v5.13.8","v5.13.7","v5.13.6","v5.13.5","v5.13.4","v5.13.3","v5.13.2","v5.13.1","v5.12.0","v5.13.0","v5.12.0-RC5","v5.12.0-RC4","v5.12.0-RC3","v5.12.0-RC2","v5.12.0-RC1","v5.12.0-RC0","v5.11.5","v5.11.4","v5.11.3","v5.11.1","v5.11.0","GitLive-blead","v5.10.0","perl-5.9.5","perl-5.9.4","perl-5.9.3","perl-5.9.2","perl-5.9.1","perl-5.9.0","perl-5.8.0","perl-5.7.3","perl-5.7.2","perl-5.7.1","perl-5.7.0","perl-5.6.0","perl-5.005","perl-5.003","perl-5.002_01","perl-5.002","perl-5.001n","perl-5.001","perl-5.000o","perl-5.000","perl-5a9","perl-5a2","perl-4.0.36","perl-4.0.00","perl-3.044","perl-3.000","perl-2.0","perl-1.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-82560.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/rra/podlators","events":[{"introduced":"0"},{"fixed":"f57dd8873dbbd1f188f3fcf7b436e4d5745f42eb"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"6.1.1"}],"source":"AFFECTED_FIELD"}}],"versions":["release/v6.1.0","release/v6.0.2","release/v6.0.1","release/v6.0.0","release/5.01","release/5.00","release/4.14","release/4.13","release/4.12","release/4.11","release/4.10","release/4.09","release/4.08","release/4.07","release/4.06","release/4.05","release/4.04","release/4.03","release/4.02","release/4.01","release/4.00","release/2.5.3","release/2.5.2","release/2.5.1","release/2.5.0","release/2.4.2","release/2.4.1","release/2.4.0","release/2.3.1","release/2.3.0","release/2.2.2","release/2.2.1","release/2.2.0","release/2.1.4","release/2.1.3","release/2.1.2","release/2.1.1","release/2.1.0","release/2.0.6","release/2.0.5","release/2.0.4","release/2.0.3","release/2.0.2","release/2.0.1","release/2.0.0","release/1.27","release/1.26","release/1.25","release/1.24","release/1.23","release/1.22","release/1.21","release/1.20","release/1.19","release/1.18","release/1.17","release/1.16","release/1.15","release/1.14","release/1.13","release/1.12","release/1.11","release/1.10","release/1.09","release/1.08","release/1.07","release/1.06","release/1.05","release/1.04","release/1.03","release/1.02","release/1.01","release/1.0","release/0.8","release/0.7","release/0.6","release/0.5","release/0.4","release/0.3","release/0.2","release/0.1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-82560.json"}}],"schema_version":"1.9.0"}