CVE-2026-8594: Text::LineFold Perl DOS Vulnerability

CVE-2026-8594 Overview

CVE-2026-8594 is a resource consumption vulnerability in the Text::LineFold Perl module, distributed as part of the Unicode-LineBreak package through version 2019.001. The module splits input strings on specific line break characters such as Vertical Tab (VT) and Form Feed (FF), but applies the break function to the entire input rather than the individual segment. As a result, the full input is duplicated for each detected segment, inflating output size and consuming excess memory and CPU. Attackers who supply crafted input to applications relying on this module can trigger denial of service conditions. The flaw maps to [CWE-405: Asymmetric Resource Consumption (Amplification)].

Critical Impact

Local attackers can submit input containing repeated special break characters to cause output duplication, exhausting memory or CPU and producing denial of service in Perl applications that process untrusted text through Text::LineFold.

Affected Products

• Unicode-LineBreak Perl distribution through version 2019.001
• Text::LineFold module shipped with the affected distribution
• Perl applications and services that invoke Text::LineFold on attacker-controlled input

Discovery Timeline

• 2026-05-30 - CVE-2026-8594 published to the National Vulnerability Database
• 2026-05-30 - Issue discussed on the OpenWall oss-security mailing list
• 2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-8594

Vulnerability Analysis

The vulnerability stems from a mismatch between how Text::LineFold segments input and how it applies its break processing. The module separates the input string on mandatory break characters such as VT (\\x0B), FF (\\x0C), and similar Unicode line separators. After splitting, the implementation invokes the break function on the original full input string rather than on each individual segment. This means every segment iteration re-processes and emits the entire input, producing output proportional to the number of segments multiplied by the input length. With a modest number of break characters, the output grows by a multiplicative factor, driving memory allocation and CPU work far beyond what the input size implies. Applications that fold log lines, email bodies, or user-submitted text become vectors for resource exhaustion. The affected logic resides in lib/Text/LineFold.pm around lines 407–415, as referenced in the MetaCPAN Source File.

Root Cause

The root cause is incorrect scoping of the break function. The code iterates over segments produced by splitting on special break characters, but it passes the original unsplit input to the break routine on each iteration. The result is asymmetric resource consumption: a short input containing several break characters yields output many times larger than the input.

Attack Vector

Exploitation requires local input delivery to a Perl process that calls Text::LineFold on untrusted data. An attacker supplies text containing multiple VT, FF, or related break characters. The module then duplicates the full input per segment, exhausting memory or CPU and resulting in process termination or unresponsiveness. No authentication or user interaction is required beyond the ability to submit input to the consuming application.

// No verified public exploit code is available.
// See the GitHub pull request and MetaCPAN patch linked in the references
// for the corrected segmentation logic.

Detection Methods for CVE-2026-8594

Indicators of Compromise

• Perl processes consuming Text::LineFold showing sudden memory growth or CPU saturation when handling text inputs
• Application logs recording out-of-memory errors or process kills correlated with text-folding operations
• Input payloads containing repeated control characters such as \\x0B (VT) or \\x0C (FF) reaching text-processing endpoints

Detection Strategies

• Inventory deployed Perl modules and identify systems running Unicode-LineBreak at or below version 2019.001 using cpan -l or package manager queries
• Instrument applications that invoke Text::LineFold to log input size, segment count, and output size, alerting when output exceeds input by an unexpected ratio
• Review application telemetry for repeated process restarts or worker crashes tied to text-handling code paths

Monitoring Recommendations

• Track Resident Set Size (RSS) and CPU usage for Perl workers handling user-supplied text and alert on sustained spikes
• Apply Web Application Firewall (WAF) or input filtering rules to detect requests containing unusually high counts of VT or FF characters
• Forward Perl application logs and host telemetry to a central platform to correlate resource exhaustion events with specific input patterns

How to Mitigate CVE-2026-8594

Immediate Actions Required

• Identify all hosts running the Unicode-LineBreak distribution and confirm the installed version of the Text::LineFold module
• Apply the upstream patch published on MetaCPAN Patch CVE-2026-8594 or upgrade to a fixed release once published
• Restrict or validate untrusted text passed to Text::LineFold until patching is complete

Patch Information

The upstream fix is tracked in the GitHub Pull Request for the Unicode-LineBreak project. The corrected logic applies the break function to each segment instead of the full input, eliminating the duplication. Administrators should rebuild and redeploy any Perl applications that bundle the affected module after applying the patch. Background and coordination details are available in the OpenWall OSS-Security Discussion.

Workarounds

• Sanitize or strip Vertical Tab, Form Feed, and similar special break characters from untrusted input before passing it to Text::LineFold
• Enforce maximum input size limits on text-processing endpoints to bound worst-case output expansion
• Run Perl workers with memory and CPU ulimit constraints so a single request cannot exhaust host resources

# Check installed Unicode-LineBreak version on a Linux host
perl -MUnicode::LineBreak -e 'print $Unicode::LineBreak::VERSION, "\n"'

# Apply the upstream patch to a local checkout
curl -O https://security.metacpan.org/patches/U/Unicode-LineBreak/2019.001/CVE-2026-8594-r1.patch
patch -p1 < CVE-2026-8594-r1.patch