Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-82560— Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width

Quick assessment

Affected
CVE-2026-82560
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 Pod::Text 模块在 6.1.1 版本之前存在漏洞，允许攻击者通过构造特定的 POD 文档导致 CPU 和内存资源耗尽。 该漏洞的成因是：每个 指令都会将其缩进量添加到页边距（margin）中，而 函数会从输出宽度中减去该页边距值，以计算可用于文本排版的可用空间。当这一可用空间降至零时，用于行分割的正则替换操作会匹配到空字符串，导致循环在未消耗任何输入数据的情况下不断重复执行，并在每次迭代中追加页边距填充内容。 因此，在格式化由攻击者提供的恶意 POD 文档时，程序将永远无法返回，输出内容会持续

AI Predicted 8.2 Difficulty: Trivial

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

I. Basic Information for CVE-2026-82560

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width
Source: CVE Program / CVE List V5
Vulnerability Description
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不可达退出条件的循环(无限循环)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 6.1.1 -
- - 0 ~ 5.45.2 -

II. Public POCs for CVE-2026-82560

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82560

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-82560 (1)

IV. Related Vulnerabilities

Same weakness: CWE-835

V. Comments for CVE-2026-82560

No comments yet

Leave a comment