CVE-2026-8594: Text::LineFold Perl DOS Vulnerability

CVE-2026-8594 Overview

CVE-2026-8594 is a resource consumption vulnerability in the Text::LineFold Perl module, distributed as part of the Unicode-LineBreak package through version 2019.001. The module splits input strings on specific line break characters such as Vertical Tab (VT) and Form Feed (FF), but applies the break function to the entire input rather than the individual segment. As a result, the full input is duplicated for each detected segment, inflating output size and consuming excess memory and CPU. Attackers who supply crafted input to applications relying on this module can trigger denial of service conditions. The flaw maps to [CWE-405: Asymmetric Resource Consumption (Amplification)].

Critical Impact
Local attackers can submit input containing repeated special break characters to cause output duplication, exhausting memory or CPU and producing denial of service in Perl applications that process untrusted text through Text::LineFold.

Affected Products

Unicode-LineBreak Perl distribution through version 2019.001
Text::LineFold module shipped with the affected distribution
Perl applications and services that invoke Text::LineFold on attacker-controlled input

Discovery Timeline

2026-05-30 - CVE-2026-8594 published to the National Vulnerability Database
2026-05-30 - Issue discussed on the OpenWall oss-security mailing list
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-8594

Vulnerability Analysis

The vulnerability stems from a mismatch between how Text::LineFold segments input and how it applies its break processing. The module separates the input string on mandatory break characters such as VT (\\x0B), FF (\\x0C), and similar Unicode line separators. After splitting, the implementation invokes the break function on the original full input string rather than on each individual segment. This means every segment iteration re-processes and emits the entire input, producing output proportional to the number of segments multiplied by the input length. With a modest number of break characters, the output grows by a multiplicative factor, driving memory allocation and CPU work far beyond what the input size implies. Applications that fold log lines, email bodies, or user-submitted text become vectors for resource exhaustion. The affected logic resides in lib/Text/LineFold.pm around lines 407–415, as referenced in the MetaCPAN Source File.

Root Cause

The root cause is incorrect scoping of the break function. The code iterates over segments produced by splitting on special break characters, but it passes the original unsplit input to the break routine on each iteration. The result is asymmetric resource consumption: a short input containing several break characters yields output many times larger than the input.

Attack Vector

Exploitation requires local input delivery to a Perl process that calls Text::LineFold on untrusted data. An attacker supplies text containing multiple VT, FF, or related break characters. The module then duplicates the full input per segment, exhausting memory or CPU and resulting in process termination or unresponsiveness. No authentication or user interaction is required beyond the ability to submit input to the consuming application.

// No verified public exploit code is available.
// See the GitHub pull request and MetaCPAN patch linked in the references
// for the corrected segmentation logic.

Detection Methods for CVE-2026-8594

Indicators of Compromise

Perl processes consuming Text::LineFold showing sudden memory growth or CPU saturation when handling text inputs
Application logs recording out-of-memory errors or process kills correlated with text-folding operations
Input payloads containing repeated control characters such as \\x0B (VT) or \\x0C (FF) reaching text-processing endpoints

Detection Strategies

Inventory deployed Perl modules and identify systems running Unicode-LineBreak at or below version 2019.001 using cpan -l or package manager queries
Instrument applications that invoke Text::LineFold to log input size, segment count, and output size, alerting when output exceeds input by an unexpected ratio
Review application telemetry for repeated process restarts or worker crashes tied to text-handling code paths

Monitoring Recommendations

Track Resident Set Size (RSS) and CPU usage for Perl workers handling user-supplied text and alert on sustained spikes
Apply Web Application Firewall (WAF) or input filtering rules to detect requests containing unusually high counts of VT or FF characters
Forward Perl application logs and host telemetry to a central platform to correlate resource exhaustion events with specific input patterns

How to Mitigate CVE-2026-8594

Immediate Actions Required

Identify all hosts running the Unicode-LineBreak distribution and confirm the installed version of the Text::LineFold module
Apply the upstream patch published on MetaCPAN Patch CVE-2026-8594 or upgrade to a fixed release once published
Restrict or validate untrusted text passed to Text::LineFold until patching is complete

Patch Information

The upstream fix is tracked in the GitHub Pull Request for the Unicode-LineBreak project. The corrected logic applies the break function to each segment instead of the full input, eliminating the duplication. Administrators should rebuild and redeploy any Perl applications that bundle the affected module after applying the patch. Background and coordination details are available in the OpenWall OSS-Security Discussion.

Workarounds

Sanitize or strip Vertical Tab, Form Feed, and similar special break characters from untrusted input before passing it to Text::LineFold
Enforce maximum input size limits on text-processing endpoints to bound worst-case output expansion
Run Perl workers with memory and CPU ulimit constraints so a single request cannot exhaust host resources

bash

# Check installed Unicode-LineBreak version on a Linux host
perl -MUnicode::LineBreak -e 'print $Unicode::LineBreak::VERSION, "\n"'

# Apply the upstream patch to a local checkout
curl -O https://security.metacpan.org/patches/U/Unicode-LineBreak/2019.001/CVE-2026-8594-r1.patch
patch -p1 < CVE-2026-8594-r1.patch