CVE-2026-82560: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-82560 is a Denial of Service vulnerability in Pod::Text (part of the podlators distribution) for Perl, caused by an infinite loop triggered when processing deeply nested =over directives in a POD document. Affected versions are Pod::Text before 6.1.1 (podlators < 6.1.1) and Perl versions up to and including 5.45.2. The vulnerability was disclosed on September 19, 2026, with a patch released the same day. The CVSS base score is not yet formally assigned (listed as 0.0 in ENISA EUVD), and the severity is estimated as Medium (GitHub Advisory, ENISA EUVD).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). Each =over directive in a POD document adds its indentation value to the cumulative margin tracked by Pod::Text. The wrap() function computes available text width by subtracting this margin from the configured output width. When deeply nested =over blocks drive the margin to equal or exceed the output width, the available width reaches zero or below, causing the line-splitting regular expression to match the empty string on every iteration — consuming no input while appending margin padding indefinitely. This results in an infinite loop and unbounded memory growth. The fix, committed by Russ Allbery on August 29, 2026, adds a guard in wrap() across Pod::Text, Pod::Text::Color, Pod::Text::Overstrike, and Pod::Text::Termcap to detect when $width <= 0, emit a warning, and reset the margin to zero (Patch, GitHub Advisory).

Successful exploitation causes complete CPU and memory exhaustion on the affected system. An attacker who can supply a malicious POD document to an application that processes it with Pod::Text can hang the application indefinitely and exhaust all available system memory, resulting in a Denial of Service condition. The impact is limited to availability; there is no evidence of confidentiality or integrity compromise (GitHub Advisory, ENISA EUVD).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the ability to supply a crafted POD document to an application that processes it with Pod::Text, which may be possible in unauthenticated scenarios where user-supplied documentation is rendered (GitHub Advisory, ENISA EUVD).

1. Craft a malicious POD document: Create a POD file containing a large number of deeply nested =over directives, each with an indentation value, such that the cumulative margin equals or exceeds the configured output width (default 76 characters). For example, 20 =over 4 blocks would produce a margin of 80, exceeding the default width.
2. Identify a target application: Find an application or service that accepts user-supplied POD documents and processes them using Pod::Text (e.g., documentation renderers, man page generators, or Perl module tools running a vulnerable version < 6.1.1).
3. Submit the malicious document: Provide the crafted POD file as input to the target application, triggering the wrap() function in Pod::Text.
4. Trigger the infinite loop: Once wrap() is called with a margin >= output width, the line-splitting regex matches the empty string, and the loop runs indefinitely, consuming CPU and growing memory until the process is killed or the system runs out of resources (Patch, GitHub Advisory).

• Process: Perl processes consuming 100% CPU for an extended or indefinite period while processing POD documents; processes with continuously growing memory usage that do not terminate.
• Logs: Application logs showing a POD formatting operation that never completes; warning messages containing "Margin is wider than the output width" (present only after patching to 6.1.1).
• File System: Unusually large temporary output files generated by Pod::Text processing that grow without bound.
• System: Out-of-memory (OOM) killer events in system logs (/var/log/syslog or dmesg) attributable to a Perl process handling POD formatting.

Upgrade Pod::Text (podlators) to version 6.1.1 or later, which adds a guard in wrap() to detect when the margin equals or exceeds the output width, emit a warning, and reset the margin to zero. For Perl distributions bundling podlators, upgrade to a Perl release that includes podlators 6.1.1 (affects Perl <= 5.45.2). As a workaround where upgrading is not immediately possible, implement resource limits (CPU timeouts, memory caps) on processes that format untrusted POD documents, and validate or reject POD input containing excessive =over nesting depth (Patch, MetaCPAN Release).

The vulnerability was discussed on the Perl 5 Porters mailing list shortly after disclosure, and the fix was committed to the main Perl 5 repository. The author, Russ Allbery, published a journal entry describing the issue. Coverage appeared in German Linux security news (Pro-Linux) and was tracked by multiple vulnerability aggregators. No major vendor statements or significant social media controversy have been observed (Perl5 Porters, Author Journal, Pro-Linux).