UBUNTU-CVE-2026-82560: High severity ubuntu/perl vulnerability

Q: What attacker control is required to trigger the issue?

An attacker must be able to supply a POD document that is subsequently formatted. The document needs sufficiently nested =over directives to make the accumulated margin reach the configured output width.

Q: What is the operational impact if the flaw is triggered?

Formatting does not return because the line-splitting loop consumes no input. It continually appends margin padding, exhausting CPU and causing output growth until available memory is exhausted.

Published Sep 19, 2026

Updated

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.

Affected Software

8 affected componentsFixes available

ubuntu/perl<5.18.2-2ubuntu1.7+esm10

5.18.2-2ubuntu1.7+esm10

ubuntu/perl<5.22.1-9ubuntu0.9+esm5

5.22.1-9ubuntu0.9+esm5

ubuntu/perl<5.26.1-6ubuntu0.7+esm5

5.26.1-6ubuntu0.7+esm5

ubuntu/perl<5.30.0-9ubuntu0.5+esm5

5.30.0-9ubuntu0.5+esm5

ubuntu/perl<5.34.0-3ubuntu1.10

5.34.0-3ubuntu1.10

ubuntu/perl<5.38.2-3.2ubuntu0.7

5.38.2-3.2ubuntu0.7

ubuntu/perl<5.42.3-1ubuntu0.1

5.42.3-1ubuntu0.1

ubuntu/perl<5.40.1-7ubuntu0.4

5.40.1-7ubuntu0.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/perl to a version that resolves this vulnerability.
Fixed in 5.18.2-2ubuntu1.7+esm10
Upgrade
Upgrade ubuntu/perl to a version that resolves this vulnerability.
Fixed in 5.22.1-9ubuntu0.9+esm5
Upgrade
Upgrade ubuntu/perl to a version that resolves this vulnerability.
Fixed in 5.26.1-6ubuntu0.7+esm5
Upgrade
Upgrade ubuntu/perl to a version that resolves this vulnerability.
Fixed in 5.30.0-9ubuntu0.5+esm5
Upgrade
Upgrade ubuntu/perl to a version that resolves this vulnerability.
Fixed in 5.34.0-3ubuntu1.10
Upgrade
Upgrade ubuntu/perl to a version that resolves this vulnerability.
Fixed in 5.38.2-3.2ubuntu0.7
Upgrade
Upgrade ubuntu/perl to a version that resolves this vulnerability.
Fixed in 5.42.3-1ubuntu0.1
Upgrade
Upgrade ubuntu/perl to a version that resolves this vulnerability.
Fixed in 5.40.1-7ubuntu0.4
Upgrade
Upgrade Pod::Text to a version that resolves this vulnerability.
Fixed in 6.1.1

Event History

Sep 19, 2026

CVE Published

via OSV·04:16 PM

Data Sourced

via OSV·04:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What attacker control is required to trigger the issue?

An attacker must be able to supply a POD document that is subsequently formatted. The document needs sufficiently nested =over directives to make the accumulated margin reach the configured output width.

What is the operational impact if the flaw is triggered?

Formatting does not return because the line-splitting loop consumes no input. It continually appends margin padding, exhausting CPU and causing output growth until available memory is exhausted.

UBUNTU-CVE-2026-82560: High severity ubuntu/perl vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What attacker control is required to trigger the issue?

What is the operational impact if the flaw is triggered?

Company

Resources

Contact

Frequently Asked Questions

What attacker control is required to trigger the issue?

What is the operational impact if the flaw is triggered?