CVE-2026-8594
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.
Text::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment.
A side effect of this is that the full input can be duplicated for each segment. Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service.
Note that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
6.2
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.
Text::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment.
A side effect of this is that the full input can be duplicated for each segment. Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service.
Note that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.
- Record
CVE-2026-8594- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-405, CWE-407
- Updated
- 2026-11-02
EUVDEUVD-2026-33466
6.2
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.
Text::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment.
A side effect of this is that the full input can be duplicated for each segment. Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service.
Note that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.
- Record
EUVD-2026-33466- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xfcf-wwr2-w555
6.2
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of...
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.
Text::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment.
A side effect of this is that the full input can be duplicated for each segment. Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service.
Note that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.
- Record
GHSA-xfcf-wwr2-w555- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-405
- Updated
- 2026-11-02
NVD
6.2
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.
Text::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment.
A side effect of this is that the full input can be duplicated for each segment. Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service.
Note that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.
- Record
CVE-2026-8594- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-405, CWE-407
- Updated
- 2026-11-02
OSV
6.2
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.
Text::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment.
A side effect of this is that the full input can be duplicated for each segment. Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service.
Note that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.
- Record
CVE-2026-8594- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-405, CWE-407
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-8594
6.2
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters. Text::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment. A side effect of this is that the full input can be duplicated for each segment. Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service. Note that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.
- Record
DEBIAN-CVE-2026-8594- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-8594
6.2
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters. Text::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment. A side effect of this is that the full input can be duplicated for each segment. Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service. Note that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.
- Record
UBUNTU-CVE-2026-8594- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-89297 No score
CVE-2026-8594 affecting package perl-Unicode-LineBreak 2019.001-7
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.
Text::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment.
A side effect of this is that the full input can be duplicated for each segment. Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service.
Note that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.
- Record
AZL-89297- Updated
- 2026-11-05
OSVMGASA-2026-0320 No score
Updated perl-Unicode-LineBreak package fixes a security vulnerability
The updated package fixes a security vulnerability: Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters. (CVE-2026-8594)
- Record
MGASA-2026-0320- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perl-Unicode-LineBreakAzure Linux:3 |
through 2019.001-7 | None known |
libunicode-linebreak-perlDebian:12 |
All versions, plus listed versions 0.0.20190101-10.0.20190101-20.0.20190101-30.0.20190101-4 |
None known |
libunicode-linebreak-perlDebian:13 |
All versions, plus listed versions 0.0.20190101-10.0.20190101-20.0.20190101-30.0.20190101-4 |
None known |
libunicode-linebreak-perlDebian:14 |
before 0.0.20190101-4, plus listed versions 0.0.20190101-10.0.20190101-20.0.20190101-3 |
0.0.20190101-4 |
perl-Unicode-LineBreakMageia:10 |
before 2019.1.0-13.1.mga10 | 2019.1.0-13.1.mga10 |
perl-Unicode-LineBreakMageia:9 |
before 2019.1.0-9.1.mga9 | 2019.1.0-9.1.mga9 |
libunicode-linebreak-perlUbuntu:16.04:LTS |
All versions, plus listed versions 0.0.20150716-10.0.20151201-10.0.20151201-1build1 |
None known |
libunicode-linebreak-perlUbuntu:18.04:LTS |
All versions, plus listed versions 0.0.20160702-1build2 |
None known |
libunicode-linebreak-perlUbuntu:20.04:LTS |
All versions, plus listed versions 0.0.20190101-10.0.20190101-1build1 |
None known |
libunicode-linebreak-perlUbuntu:22.04:LTS |
All versions, plus listed versions 0.0.20190101-1build20.0.20190101-1build3 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libunicode-linebreak-perlUbuntu:24.04:LTS |
All versions, plus listed versions 0.0.20190101-1build40.0.20190101-1build50.0.20190101-1build60.0.20190101-1build7 |
None known |
libunicode-linebreak-perlUbuntu:25.10 |
All versions, plus listed versions 0.0.20190101-1build8 |
None known |
libunicode-linebreak-perlUbuntu:26.10 |
All versions, plus listed versions 0.0.20190101-30.0.20190101-40.0.20190101-4build1 |
None known |
libunicode-linebreak-perlUbuntu:26.04:LTS |
All versions, plus listed versions 0.0.20190101-1build80.0.20190101-20.0.20190101-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-8594 is a medium vulnerability (CVSS 6.2) in Nezumi Text::linefold, published May 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in libunicode-linebreak-perl 0.0.20190101-4.
References
metacpan.org/release/NEZUMI/Unicode-LineBreak-2019.001/source/lib/Text/LineFold.pm
security.metacpan.org/patches/U/Unicode-LineBreak/2019.001/CVE-2026-8594-r1.patch
github.com/hatukanezumi/Unicode-LineBreak/pull/6
openwall.com/lists/oss-security/2026/05/30/6
nvd.nist.gov/vuln/detail/CVE-2026-8594
github.com/advisories/GHSA-xfcf-wwr2-w555
Show 9 moreShow less
cpan.org/modules
github.com/hatukanezumi/Unicode-LineBreak
github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8594.json
security-tracker.debian.org/tracker/CVE-2026-8594
advisories.mageia.org/MGASA-2026-0320.html
bugs.mageia.org/show_bug.cgi?id=35612
ubuntu.com/security/CVE-2026-8594
cve.org/CVERecord?id=CVE-2026-8594
lists.security.metacpan.org/cve-announce/msg/40542383