Text::LineFold CVE-2026-8594

Exploitation requires that Text::LineFold's fold() method be called with attacker-controlled input containing multiple Unicode special line break characters (VT U+000B, FF U+000C, or other Unicode-defined line terminators). The amplification severity scales with the density of these characters in the input, so a meaningful DoS requires the ability to inject a non-trivial number of such characters. CVSS AV:L indicates the attack vector is local, meaning exploitation is limited to contexts where the attacker can supply crafted strings to a process running Text::LineFold on the same system, or to applications (web services, daemons) that accept and forward such input without sanitization. Exploitation is limited by: (1) the local attack vector constraint - pure remote unauthenticated exploitation via network is not confirmed by CVSS; (2) applications that normalize or strip Unicode control characters before calling fold(); (3) input length limits enforced upstream of fold(); (4) no impact on confidentiality or integrity - only availability is affected.

CVSS 6.2 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H rates this as a local, low-complexity, availability-only issue - the local attack vector (AV:L) substantially constrains the threat surface compared to a network-exploitable DoS. EPSS at 0.01% in the 0th percentile reflects essentially zero observed exploitation probability in the wild. The vulnerability is absent from CISA KEV and no public exploit code has been identified. These signals collectively indicate this is a correctness bug with DoS potential rather than an actively targeted vulnerability. Real-world risk is highest in applications that (a) run as a service accepting untrusted text, (b) pass that text through Text::LineFold's fold() without input sanitization, and (c) operate in resource-constrained environments. The amplification factor is bounded by the number of Unicode break characters an attacker can inject, making targeted crafting necessary for meaningful impact. The CVSS PR:N rating means no authentication is required, but the AV:L constraint means the attacker must be able to reach a local process or provide input that flows into fold() - remote exploitation is not confirmed by the available data.

An attacker submits a crafted text string densely populated with Unicode vertical tab (VT) or form feed (FF) characters to a Perl application - such as a text formatter, email composer, or report generator - that calls Text::LineFold's fold() method on user-supplied content. Each special break character causes an additional full-string duplication in the output buffer, causing memory and CPU consumption to grow proportionally; a moderately sized input with hundreds of break characters could generate output tens or hundreds of times larger, eventually exhausting process memory or triggering an out-of-memory condition. No public exploit code has been identified at time of analysis.