EUVD-2026-83606
GHSA-qcgj-vx8w-rqfq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft POD with deep =over nesting
-
DeliverySubmit document to Pod::Text formatter
-
ExploitMargin reaches/exceeds output width
-
Executionwrap() loop matches empty string, never advances
-
PersistCPU spin and unbounded memory growth
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an application or service to format an ATTACKER-SUPPLIED POD document using Pod::Text or one of its subclasses (Pod::Text::Color, ::Overstrike, ::Termcap) at a version before 6.1.1. The trigger is a document whose cumulative |
| Impact | This is a genuine but modest-priority denial-of-service issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a clean availability-only impact with no confidentiality or integrity consequences - CWE-835 infinite loop plus unbounded memory growth. All exploitation-likelihood signals point low: EPSS is 0.21% (11th percentile), the flaw is NOT in CISA KEV, and no public exploit code is referenced. SSVC corroborates this - Exploitation: none, Automatable: yes, Technical Impact: partial - meaning that while an attack would be scriptable if a service exposes POD rendering, no active exploitation is observed and the impact is bounded to availability. The one caveat is the CVSS 'AV:N': network reachability is real only when an application feeds attacker-controlled POD to Pod::Text (e.g., a web service rendering user-submitted POD); for the common local |
| Exploit ScenarioDerived | A service that renders user-supplied POD to text using Pod::Text (or its Color/Overstrike/Termcap subclasses) with a constrained output width accepts a document containing deeply nested |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Formatting an attacker-supplied POD document with Pod::Text (part of the podlators distribution) before version 6.1.1 drives the formatter into a non-terminating loop that exhausts CPU and memory, allowing a remote unauthenticated attacker who controls the POD content to deny service to any application or service that renders untrusted POD. The trigger is a document with deeply nested =over directives whose cumulative indentation makes the wrapping margin greater than or equal to the configured output width, so that wrap() has zero or negative space for text, matches the empty string in its line-splitting substitution, and appends padding forever without consuming input. Exploitation status is limited: no public exploit code was identified at time of analysis, CISA SSVC records exploitation as none, and EPSS is low at 0.21% (11th percentile), so this is a genuine but modest-priority availability issue whose real-world risk is concentrated on services that render untrusted POD rather than on the ordinary local pod2text/perldoc workflow.
RemediationAI
Upgrade the podlators distribution to 6.1.1 or later, which is the vendor-released patch for this issue (Pod::Text 6.1.1 and its Color, Overstrike and Termcap subclasses); the exact fix is the upstream commit 70510174f69eb54aa6d617bde4e1402cd9b7c61f, available as a patch at https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch, with the fix described in https://metacpan.org/release/RRA/podlators-v6.1.1/changes. Where the upgrade cannot be applied immediately, the effective compensating control is to constrain the POD input reaching the formatter, since exploitation requires attacker-controlled document content: sanitize or reject untrusted POD, or strip/cap the nesting depth of =over directives before formatting, with the trade-off that legitimate deeply indented documentation may render with altered indentation. Raising the output width option above the maximum achievable accumulated margin also prevents the zero-space condition that triggers the loop, but it does not reduce the CPU cost of formatting very large documents and changes output layout. For services that render POD on behalf of remote users, run the formatter under hard OS-level resource limits - a CPU timeout plus RLIMIT_AS or a cgroup memory cap so the process is killed when the loop starts growing output - accepting that such requests will fail while the underlying vulnerability remains present, and avoid running the formatter with elevated privileges. Additional advisory detail is available at https://nvd.nist.gov/vuln/detail/CVE-2026-82560 and in the oss-security/Openwall threads referenced above. CISA SSVC rates exploitation as none and EPSS is 0.21% (11th percentile), so remediation can be scheduled at normal priority rather than emergency urgency.
Affected ProductsAI
Pod::Text (podlators) versions before 6.1.1 are affected, together with the subclass formatters that share the vulnerable wrapping code: Pod::Text::Color, Pod::Text::Overstrike and Pod::Text::Termcap. The pre-fix source corresponding to the vulnerable logic is documented at the podlators v6.1.0 release (https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261), and the fix is published in the podlators v6.1.1 changes file (https://metacpan.org/release/RRA/podlators-v6.1.1/changes). The issue was reported by CPANSec and coordinated through the oss-security and Openwall mailing lists (http://www.openwall.com/lists/oss-security/2026/09/19/6 and https://seclists.org/oss-sec/2026/q3/842), with an additional write-up at https://vuldb.com/vuln/407954 and an ENISA EUVD record (EUVD-2026-83606) referencing the NVD entry. No CPE strings were supplied in the source data, so affected installations should be identified by podlators version rather than by CPE matching.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pod::Text is the base POD-to-plain-text formatter shipped in the Perl podlators distribution and is used by tools such as pod2text and perldoc, with Pod::Text::Color, Pod::Text::Overstrike and Pod::Text::Termcap as subclasses that share the same wrap() implementation. The root cause class is CWE-835, a loop with an unreachable exit condition: each =over directive adds its indent to a running margin, and wrap() subtracts that margin from the output width to compute the space available for text. When the margin reaches or exceeds the width, the available space becomes zero or negative, the internal split substitution matches the empty string, and the loop neither advances through the input nor exits, while the margin padding is appended on every iteration, producing unbounded output growth until memory is exhausted. The upstream fix in commit 70510174f69eb54aa6d617bde4e1402cd9b7c61f adds a guard in the wrap() methods of Pod::Text, Pod::Text::Color, Pod::Text::Overstrike and Pod::Text::Termcap: when the computed width is less than or equal to zero, it emits a new "Margin is wider than the output width" warning, clears the padding and resets the width to the configured output width so formatting can proceed. The assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms a network-reachable, unauthenticated, no-user-interaction denial of service with no confidentiality or integrity impact, and there is no code execution, privilege escalation or data disclosure path associated with the flaw.
Know when Perl gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Availability-only infinite-loop/memory-exhaustion; crafting the pathological =over nesting is trivial (AC:L) and needs no auth in the library, though AV:N assumes a service exposing POD rendering.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.
Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.
Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.
Executive ViewAI
The Pod::Text formatter in the podlators distribution before version 6.1.1 is vulnerable to a denial-of-service condition that can exhaust CPU and memory when processing a crafted POD document. Organizations that render untrusted POD content-such as documentation pipelines or web-based viewers-face potential service outages. While no public exploit identified at time of analysis and exploitation likelihood is low, the availability risk warrants prompt remediation (Vendor-released patch: 6.1.1).
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid
Silently incorrect regular-expression matching in the Perl interpreter (all versions through 5.43.9) lets an oversized a
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive informa
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVS
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which mig
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers
Exploit-DB