CVE-2026-82560 in Pod::Text
Summary
by MITRE • 09/19/2026
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.
Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.
Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified in Pod::Text versions prior to 6.1.1 represents a critical resource exhaustion flaw rooted in improper handling of nested formatting directives within Perl documentation files. This module serves as a core component for converting Plain Old Documentation, or POD, into various output formats such as plain text and HTML. The specific defect arises from the interaction between the =over directive used to create indented lists and the internal logic responsible for calculating available line width for text wrapping. When processing a maliciously crafted POD document containing deeply nested =over blocks, each level of nesting increments an indent counter that is subsequently subtracted from the total output width to determine the space remaining for actual content. This arithmetic operation fails to account for scenarios where cumulative indentation exceeds or equals the defined output width, leading to a calculation error in the available text buffer size.
As the parser processes these nested structures, the calculated space available for text eventually reaches zero or becomes negative due to integer underflow behavior depending on the specific implementation details of the subtraction operation. This miscalculation triggers a catastrophic failure within the line-splitting substitution routine designed to wrap long lines of text. Instead of handling empty or insufficient spaces gracefully by breaking lines at appropriate boundaries, the regular expression matches against an empty string condition that results in no input consumption during each iteration of the processing loop. Consequently, the system enters an infinite execution cycle where it continuously appends margin padding characters without advancing through the document content. This behavior effectively creates a denial-of-service vector wherein the application hangs indefinitely while consuming increasing amounts of central processing unit cycles and memory resources until the host system is exhausted or terminated by operating system safeguards.
From a security classification perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, specifically manifesting as an infinite loop that leads to CPU exhaustion and potential out-of-memory conditions. It also maps closely to CWE-675, operations on unconstrained inputs, as the parser does not validate or limit the depth of nesting provided by user-supplied documentation files. In terms of adversary tactics, this flaw can be leveraged within the MITRE ATT&CK framework under T1499, Endpoint Denial of Service, where an attacker utilizes a specific payload to degrade system availability without necessarily compromising confidentiality or integrity. The impact is primarily operational disruption, as services relying on Pod::Text for generating documentation will become unresponsive and may crash if memory limits are breached.
Mitigation strategies must focus on immediate patching and defensive coding practices. Organizations should upgrade the Perl environment to include Pod::Text version 6.1.1 or later, where this logic error has been corrected by implementing proper bounds checking on indentation levels relative to output width. For environments unable to update immediately, input validation mechanisms can be deployed at the ingestion layer to reject POD documents that exceed a predefined nesting depth threshold before they reach the parsing engine. Additionally, configuring resource limits such as memory caps and execution timeouts for processes handling untrusted documentation inputs can provide a secondary defense-in-depth measure to prevent total system compromise while longer-term remediation is implemented.