CVE-2026-82560: Pod::Text for Perl DOS Vulnerability

CVE-2026-82560 Overview

CVE-2026-82560 is a denial-of-service vulnerability in the Pod::Text Perl module versions before 6.1.1. The flaw resides in the wrap() function within lib/Pod/Text.pm, which formats Plain Old Documentation (POD) into plain text output. When a POD document contains deeply nested =over directives, the cumulative indent margin can equal or exceed the configured output width. This produces a zero or negative wrapping width, causing the line-splitting regular expression to match the empty string and loop indefinitely while appending margin padding. The result is unbounded CPU and memory consumption when processing attacker-supplied POD content. The issue is classified as an infinite loop condition [CWE-835].

Critical Impact
Processing a crafted POD document with Pod::Text never returns and exhausts available memory, enabling denial of service against any tool or documentation pipeline that formats untrusted POD input.

Affected Products

Pod::Text for Perl, all versions prior to 6.1.1
Pod::Text::Color for Perl, prior to the patched podlators v6.1.1 release
podlators distribution versions up to and including v6.1.0

Discovery Timeline

2026-09-19 - CVE-2026-82560 published to NVD and discussed on the Openwall oss-security list
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-82560

Vulnerability Analysis

The wrap() routine in Pod::Text calculates the usable text width by subtracting the current margin from the configured output width. Each =over directive in a POD document increases the margin by its indent value. When nested =over blocks accumulate enough indent to reach or exceed opt_width, the computed wrapping width becomes zero or negative.

Inside the wrapping loop, the regular expressions s/^([^\n]{0,$width})[ \t\n]+// and s/^([^\n]{$width})// are used to consume text. With a width of zero, the first pattern matches the empty string successfully, removes no input, and appends the margin padding to the output on every iteration. The loop never terminates.

Because the loop appends $spaces (the margin padding) on each pass without reducing the remaining input, the output buffer grows without bound until memory is exhausted or the process is killed.

Root Cause

The root cause is missing validation of the computed wrapping width before entering the substitution loop. Neither Pod::Text nor Pod::Text::Color verified that opt_width - MARGIN yielded a positive value, so a pathological nesting depth produced a degenerate regex match that consumed no input.

Attack Vector

An attacker supplies a POD document with deeply nested =over directives. Any application that renders untrusted POD content through Pod::Text or Pod::Text::Color becomes unresponsive and eventually crashes from memory exhaustion. Common exposure paths include CPAN toolchains, documentation generators, and web services that convert user-submitted POD to plain text.

perl

# Patch to lib/Pod/Text.pm (podlators commit 70510174)
    my $output = '';
    my $spaces = ' ' x $$self{MARGIN};
    my $width = $$self{opt_width} - $$self{MARGIN};

    # Pathological margins make wrapping impossible.  In this case, complain
    # to the user and reset the margin to 0.
    if ($width <= 0) {
        my $error = 'Margin is wider than the output width';
        $self->whine($self->line_count(), $error);
        $spaces = q{};
        $width = $self->{opt_width};
    }

    # Perform the wrapping.
    while (length > $width) {
        if (s/^([^\n]{0,$width})[ \t\n]+// || s/^([^\n]{$width})//) {
            $output .= $spaces . $1 . "\n";

Source: GitHub Commit Patch

Detection Methods for CVE-2026-82560

Indicators of Compromise

Perl processes running pod2text, Pod::Text, or Pod::Text::Color that consume sustained high CPU with steadily growing resident memory
POD input files or documents containing an unusually deep chain of =over directives without matching =back closures
Documentation build or CPAN tooling jobs that stop making progress and eventually OOM-kill

Detection Strategies

Inventory Perl environments and identify installed versions of the podlators distribution; flag any version earlier than 6.1.1
Add runtime resource limits (CPU time, RSS) around any process that formats untrusted POD, and alert when limits trigger
Scan repositories, package uploads, and user-submitted content for POD files with excessive =over nesting depth prior to rendering

Monitoring Recommendations

Monitor process telemetry for perl processes exceeding memory or CPU thresholds during documentation rendering jobs
Log and review invocations of pod2text and downstream tools such as perldoc for abnormal runtime durations
Instrument documentation pipelines with timeouts so runaway wrap() executions terminate deterministically

How to Mitigate CVE-2026-82560

Immediate Actions Required

Upgrade the podlators distribution to version 6.1.1 or later on all systems where Perl is installed
Audit CI/CD, documentation generation, and web-facing services that process POD input from untrusted sources
Apply strict CPU time and memory ulimits to any process that renders POD supplied by external users

Patch Information

The fix is included in podlators v6.1.1. The patch introduces a guard that detects a non-positive wrapping width, emits a warning through whine(), resets the margin to empty, and restores opt_width before entering the substitution loop. The same correction is applied to both lib/Pod/Text.pm and lib/Pod/Text/Color.pm. See the MetaCPAN Podlators Change Log and the GitHub Commit Patch for details.

Workarounds

Reject or sanitize POD inputs whose cumulative =over indent could exceed the configured output width
Wrap invocations of Pod::Text in alarm()-based timeouts to bound execution time
Enforce OS-level resource limits such as RLIMIT_AS and RLIMIT_CPU on processes handling untrusted POD

bash

# Upgrade podlators via cpanm and verify installed version
cpanm RRA/podlators-v6.1.1.tar.gz
perl -MPod::Text -e 'print $Pod::Text::VERSION, "\n"'

# Enforce resource limits around any process rendering untrusted POD
ulimit -t 10   # 10 seconds of CPU time
ulimit -v 524288  # 512 MB address space
pod2text untrusted.pod > output.txt