{"id":"CVE-2026-82560","aliases":["AZL-103320","BELL-CVE-2026-82560","DEBIAN-CVE-2026-82560","EUVD-2026-83606","GHSA-qcgj-vx8w-rqfq","OESA-2026-4202","OESA-2026-4203","OESA-2026-4204","OESA-2026-4205","ROOT-OS-DEBIAN-12-CVE-2026-82560","ROOT-OS-DEBIAN-13-CVE-2026-82560","UBUNTU-CVE-2026-82560","USN-9006-1"],"status":"published","title":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0063,"percentile":0.50527,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2026-09-19T15:15:52Z","modified":"2026-11-11T09:41:11Z","fixes":[{"ecosystem":"Azure Linux:3","package":"perl","fixed_in":["5.38.2-517"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"perl","fixed_in":["5.36.3-r4"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"perl","fixed_in":["5.40.4-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"perl","fixed_in":["5.44.0-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"perl","fixed_in":["5.36.3-r4"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"perl","fixed_in":["5.40.4-r3"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"perl","fixed_in":["5.44.0-r1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-podlators","fixed_in":["5.01-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-podlators","fixed_in":["5.01-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-podlators","fixed_in":["5.01-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"perl-podlators","fixed_in":["5.01-3.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"perl","fixed_in":["5.36.0-7+deb12u4.aikido.21","5.36.0-7+deb12u4.aikido.20"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-perl","fixed_in":["5.36.0-7+deb12u4.aikido.21","5.36.0-7+deb12u4.aikido.20"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"perl","fixed_in":["5.40.1-6+deb13u1.aikido.12"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-perl","fixed_in":["5.40.1-6+deb13u1.aikido.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"perl","fixed_in":["5.18.2-2ubuntu1.7+esm10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"perl","fixed_in":["5.22.1-9ubuntu0.9+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"perl","fixed_in":["5.26.1-6ubuntu0.7+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"perl","fixed_in":["5.30.0-9ubuntu0.5+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"perl","fixed_in":["5.34.0-3ubuntu1.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"perl","fixed_in":["5.38.2-3.2ubuntu0.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"perl","fixed_in":["5.42.3-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"perl","fixed_in":["5.40.1-7ubuntu0.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-517"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.36.0-r0"},{"fixed":"5.36.3-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.40.2-r0"},{"fixed":"5.40.4-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.36.0-r0"},{"fixed":"5.44.0-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.36.0-r0"},{"fixed":"5.36.3-r4"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.40.2-r0"},{"fixed":"5.40.4-r3"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.36.0-r0"},{"fixed":"5.44.0-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.36.0-10","5.36.0-7","5.36.0-7+deb12u1","5.36.0-7+deb12u2","5.36.0-7+deb12u3","5.36.0-8","5.36.0-9","5.38.0-1","5.38.0-2","5.38.0~rc2-1","5.38.2-1","5.38.2-2","5.38.2-3","5.38.2-3.1","5.38.2-3.2","5.38.2-3.2+hurd.1","5.38.2-4","5.38.2-5","5.40.0-1","5.40.0-2","5.40.0-3","5.40.0-4","5.40.0-5","5.40.0-6","5.40.0-7","5.40.0-8","5.40.0~rc1-1","5.40.1-1","5.40.1-2","5.40.1-3","5.40.1-4","5.40.1-5","5.40.1-6","5.40.1-7","5.40.1-8","5.42.0-1","5.42.0-2","5.42.0-3","5.42.2-1","5.42.2-2","5.42.2-3","5.42.3-1","5.44.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.40.1-6","5.40.1-6+deb13u1","5.40.1-7","5.40.1-8","5.42.0-1","5.42.0-2","5.42.0-3","5.42.2-1","5.42.2-2","5.42.2-3","5.42.3-1","5.44.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.40.1-6","5.40.1-7","5.40.1-8","5.42.0-1","5.42.0-2","5.42.0-3","5.42.2-1","5.42.2-2","5.42.2-3","5.42.3-1","5.44.0-1"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-podlators","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.01-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-podlators","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.01-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-podlators","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.01-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"perl-podlators","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.01-3.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.36.0-7+deb12u4.aikido.21"},{"fixed":"5.36.0-7+deb12u4.aikido.20"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.36.0-7+deb12u4.aikido.21"},{"fixed":"5.36.0-7+deb12u4.aikido.20"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-6+deb13u1.aikido.12"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-6+deb13u1.aikido.12"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-2ubuntu1.7+esm10"}]}],"versions":["5.14.2-21build1","5.18.1-4","5.18.1-4build1","5.18.1-5","5.18.2-2","5.18.2-2ubuntu1","5.18.2-2ubuntu1.1","5.18.2-2ubuntu1.3","5.18.2-2ubuntu1.4","5.18.2-2ubuntu1.6","5.18.2-2ubuntu1.7","5.18.2-2ubuntu1.7+esm3","5.18.2-2ubuntu1.7+esm4","5.18.2-2ubuntu1.7+esm5","5.18.2-2ubuntu1.7+esm7","5.18.2-2ubuntu1.7+esm8","5.18.2-2ubuntu1.7+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+esm5"}]}],"versions":["5.20.2-6","5.22.1-3","5.22.1-4","5.22.1-5","5.22.1-7","5.22.1-8","5.22.1-9","5.22.1-9ubuntu0.2","5.22.1-9ubuntu0.3","5.22.1-9ubuntu0.5","5.22.1-9ubuntu0.6","5.22.1-9ubuntu0.9","5.22.1-9ubuntu0.9+esm1","5.22.1-9ubuntu0.9+esm2","5.22.1-9ubuntu0.9+esm3","5.22.1-9ubuntu0.9+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+esm5"}]}],"versions":["5.26.0-8ubuntu1","5.26.1-2ubuntu1","5.26.1-3","5.26.1-4","5.26.1-4build1","5.26.1-5","5.26.1-6","5.26.1-6ubuntu0.1","5.26.1-6ubuntu0.2","5.26.1-6ubuntu0.3","5.26.1-6ubuntu0.5","5.26.1-6ubuntu0.6","5.26.1-6ubuntu0.7","5.26.1-6ubuntu0.7+esm2","5.26.1-6ubuntu0.7+esm3","5.26.1-6ubuntu0.7+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.0-9ubuntu0.5+esm5"}]}],"versions":["5.28.1-6build1","5.30.0-7","5.30.0-9","5.30.0-9build1","5.30.0-9ubuntu0.2","5.30.0-9ubuntu0.3","5.30.0-9ubuntu0.4","5.30.0-9ubuntu0.5","5.30.0-9ubuntu0.5+esm2","5.30.0-9ubuntu0.5+esm3","5.30.0-9ubuntu0.5+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.34.0-3ubuntu1.10"}]}],"versions":["5.32.1-3ubuntu3","5.34.0-3ubuntu1","5.34.0-3ubuntu1.1","5.34.0-3ubuntu1.2","5.34.0-3ubuntu1.3","5.34.0-3ubuntu1.4","5.34.0-3ubuntu1.5","5.34.0-3ubuntu1.7","5.34.0-3ubuntu1.8","5.34.0-3ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-3.2ubuntu0.7"}]}],"versions":["5.36.0-9ubuntu1","5.36.0-10ubuntu1","5.38.2-3","5.38.2-3.2","5.38.2-3.2build1","5.38.2-3.2build2","5.38.2-3.2build2.1","5.38.2-3.2ubuntu0.1","5.38.2-3.2ubuntu0.2","5.38.2-3.2ubuntu0.3","5.38.2-3.2ubuntu0.4","5.38.2-3.2ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.42.3-1ubuntu0.1"}]}],"versions":["5.40.1-7build1","5.40.1-8","5.40.1-8ubuntu1","5.42.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-7ubuntu0.4"}]}],"versions":["5.40.1-6build1","5.40.1-7build1","5.40.1-7ubuntu0.1","5.40.1-7ubuntu0.2","5.40.1-7ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-2ubuntu1.7+esm10"}]}],"versions":["5.14.2-21build1","5.18.1-4","5.18.1-4build1","5.18.1-5","5.18.2-2","5.18.2-2ubuntu1","5.18.2-2ubuntu1.1","5.18.2-2ubuntu1.3","5.18.2-2ubuntu1.4","5.18.2-2ubuntu1.6","5.18.2-2ubuntu1.7","5.18.2-2ubuntu1.7+esm3","5.18.2-2ubuntu1.7+esm4","5.18.2-2ubuntu1.7+esm5","5.18.2-2ubuntu1.7+esm7","5.18.2-2ubuntu1.7+esm8","5.18.2-2ubuntu1.7+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+esm5"}]}],"versions":["5.20.2-6","5.22.1-3","5.22.1-4","5.22.1-5","5.22.1-7","5.22.1-8","5.22.1-9","5.22.1-9ubuntu0.2","5.22.1-9ubuntu0.3","5.22.1-9ubuntu0.5","5.22.1-9ubuntu0.6","5.22.1-9ubuntu0.9","5.22.1-9ubuntu0.9+esm1","5.22.1-9ubuntu0.9+esm2","5.22.1-9ubuntu0.9+esm3","5.22.1-9ubuntu0.9+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+esm5"}]}],"versions":["5.26.0-8ubuntu1","5.26.1-2ubuntu1","5.26.1-3","5.26.1-4","5.26.1-4build1","5.26.1-5","5.26.1-6","5.26.1-6ubuntu0.1","5.26.1-6ubuntu0.2","5.26.1-6ubuntu0.3","5.26.1-6ubuntu0.5","5.26.1-6ubuntu0.6","5.26.1-6ubuntu0.7","5.26.1-6ubuntu0.7+esm2","5.26.1-6ubuntu0.7+esm3","5.26.1-6ubuntu0.7+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.0-9ubuntu0.5+esm5"}]}],"versions":["5.28.1-6build1","5.30.0-7","5.30.0-9","5.30.0-9build1","5.30.0-9ubuntu0.2","5.30.0-9ubuntu0.3","5.30.0-9ubuntu0.4","5.30.0-9ubuntu0.5","5.30.0-9ubuntu0.5+esm2","5.30.0-9ubuntu0.5+esm3","5.30.0-9ubuntu0.5+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.34.0-3ubuntu1.10"}]}],"versions":["5.32.1-3ubuntu3","5.34.0-3ubuntu1","5.34.0-3ubuntu1.1","5.34.0-3ubuntu1.2","5.34.0-3ubuntu1.3","5.34.0-3ubuntu1.4","5.34.0-3ubuntu1.5","5.34.0-3ubuntu1.7","5.34.0-3ubuntu1.8","5.34.0-3ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-3.2ubuntu0.7"}]}],"versions":["5.36.0-9ubuntu1","5.36.0-10ubuntu1","5.38.2-3","5.38.2-3.2","5.38.2-3.2build1","5.38.2-3.2build2","5.38.2-3.2build2.1","5.38.2-3.2ubuntu0.1","5.38.2-3.2ubuntu0.2","5.38.2-3.2ubuntu0.3","5.38.2-3.2ubuntu0.4","5.38.2-3.2ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.42.3-1ubuntu0.1"}]}],"versions":["5.40.1-7build1","5.40.1-8","5.40.1-8ubuntu1","5.42.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-7ubuntu0.4"}]}],"versions":["5.40.1-6build1","5.40.1-7build1","5.40.1-7ubuntu0.1","5.40.1-7ubuntu0.2","5.40.1-7ubuntu0.3"]}],"references":[{"url":"https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","tags":["web","report"]},{"url":"https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","tags":["patch","fix","report"]},{"url":"https://metacpan.org/release/RRA/podlators-v6.1.1/changes","tags":["release-notes","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/19/6","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qcgj-vx8w-rqfq"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-82560","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82560.json","tags":["advisory"]},{"url":"https://github.com/Perl/perl5","tags":["package"]},{"url":"https://github.com/rra/podlators","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-82560","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4202","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4203","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4204","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4205","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-82560","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82560","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/43682367/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-9006-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-82560","title":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.","status":"published","published":"2026-09-19T15:15:52.62Z","modified":"2026-09-21T18:38:31.266Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T13:40:35.004553Z"}],"euvd":[{"id":"EUVD-2026-83606","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.","status":"published","published":"2026-09-19T15:15:52Z","modified":"2026-09-21T18:38:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:04.588371Z"}],"ghsa":[{"id":"GHSA-qcgj-vx8w-rqfq","title":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD...","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.","status":"published","published":"2026-09-19T18:30:26Z","modified":"2026-09-21T21:31:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:12:15.996228Z"}],"nvd":[{"id":"CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.","status":"published","published":"2026-09-19T16:16:32.14Z","modified":"2026-09-22T19:07:00.983Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:12:50.043898Z"}],"osv":[{"id":"BELL-CVE-2026-82560","status":"published","published":"2026-09-23T06:08:04.618249Z","modified":"2026-10-13T07:15:02.047189222Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:26.341144Z"},{"id":"CVE-2026-82560","title":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.","status":"published","published":"2026-09-19T15:15:52.62Z","modified":"2026-10-28T02:59:56.071723461Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:45:18.131258Z"},{"id":"DEBIAN-CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.  Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.  Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.","status":"published","published":"2026-09-19T16:16:32.14Z","modified":"2026-09-23T08:47:36.334082357Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"OESA-2026-4202","title":"perl-podlators security update","description":"podlators contains Pod::Man and Pod::Text modules which convert POD input to *roff source output, suitable for man pages, or plain text.  It also includes several subclasses of Pod::Text for formatted output to terminals with various capabilities.  It is the source package for the Pod::Man and Pod::Text modules included with Perl.\r\n\r\nSecurity Fix(es):\n\nPod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.(CVE-2026-82560)","status":"published","published":"2026-09-30T13:47:34Z","modified":"2026-10-01T02:00:06.70834025Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4203","title":"perl-podlators security update","description":"podlators contains Pod::Man and Pod::Text modules which convert POD input to *roff source output, suitable for man pages, or plain text.  It also includes several subclasses of Pod::Text for formatted output to terminals with various capabilities.  It is the source package for the Pod::Man and Pod::Text modules included with Perl.\r\n\r\nSecurity Fix(es):\n\nPod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.(CVE-2026-82560)","status":"published","published":"2026-09-30T13:47:35Z","modified":"2026-10-01T02:00:07.833957447Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4204","title":"perl-podlators security update","description":"podlators contains Pod::Man and Pod::Text modules which convert POD input to *roff source output, suitable for man pages, or plain text.  It also includes several subclasses of Pod::Text for formatted output to terminals with various capabilities.  It is the source package for the Pod::Man and Pod::Text modules included with Perl.\r\n\r\nSecurity Fix(es):\n\nPod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.(CVE-2026-82560)","status":"published","published":"2026-09-30T13:47:35Z","modified":"2026-10-01T02:00:06.768794343Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4205","title":"perl-podlators security update","description":"podlators contains Pod::Man and Pod::Text modules which convert POD input to *roff source output, suitable for man pages, or plain text.  It also includes several subclasses of Pod::Text for formatted output to terminals with various capabilities.  It is the source package for the Pod::Man and Pod::Text modules included with Perl.\r\n\r\nSecurity Fix(es):\n\nPod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.(CVE-2026-82560)","status":"published","published":"2026-09-30T13:47:36Z","modified":"2026-10-01T02:00:06.774286915Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"UBUNTU-CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.","status":"published","published":"2026-09-19T16:16:00Z","modified":"2026-11-11T09:41:11.41392328Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T10:03:16.170826Z"},{"id":"AZL-103320","title":"CVE-2026-82560 affecting package perl for versions less than 5.38.2-517","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.","status":"published","published":"2026-09-19T16:16:32Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.528763Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-82560","title":"CVE-2026-82560 in perl - Patched by Root","description":"Root has patched CVE-2026-82560 in the perl package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-12T09:51:35Z","modified":"2026-10-12T10:15:03.577675577Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-82560","title":"CVE-2026-82560 in perl - Patched by Root","description":"Root has patched CVE-2026-82560 in the perl package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-09-28T12:43:46Z","modified":"2026-09-28T13:15:07.596093679Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"USN-9006-1","title":"perl vulnerability","description":"It was discovered that Pod::Text in Perl did not properly handle POD\ndocuments with deeply nested =over directives. If a user or automated\nsystem were tricked into processing a specially crafted file, an\nattacker could possibly use this issue to cause CPU and memory\nexhaustion, resulting in a denial of service.","status":"published","published":"2026-11-09T05:05:29Z","modified":"2026-11-11T09:34:57.78040108Z","updated_at":"2026-11-11T10:04:27.123105Z"}]}}