Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.
Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
||||||||
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to podlators v6.1.1 or later.
Vendor Workaround
Until a Perl release carries the fix, install podlators v6.1.1 or later, which takes precedence over the bundled copy.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sat, 19 Sep 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Sat, 19 Sep 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted. | |
| Title | Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width | |
| Weaknesses | CWE-835 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-09-19T20:07:17.026Z
Reserved: 2026-08-29T22:38:15.085Z
Link: CVE-2026-82560
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-19T16:16:32.140
Modified: 2026-09-19T21:16:27.340
Link: CVE-2026-82560
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-09-19T21:30:16Z
-
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')