CVE-2026-82560

HighCVSS 7.5/10Last modified Sep 22, 2026

Description

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.

Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.

Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Sep 19, 2026
Last modified
Sep 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-825616.5Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow dCVE-2026-825623.7### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push kCVE-2026-825637.6An attacker could impersonate the camera and place themselves in a man-in-the-middle or device-emulation position. This permits manipulationCVE-2026-825647.1Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to updatCVE-2026-825668.8The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the CVE-2026-825676.3The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. TheCVE-2026-82575.5A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function IRBuilder::makeBrOn of the file src/wasm/wasCVE-2026-825787.5When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with noCVE-2026-825796.0Loop with Unreachable Exit Condition (Infinite Loop) vulnerability in ash-project ash_ai allows an attacker who can influence a model's outpCVE-2026-82585.3A flaw has been found in Squirrel up to 3.2. Impacted is the function validate_format in the library sqstdlib/sqstdstring.cpp. Executing a mCVE-2026-825805.3Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal error text to chat usersCVE-2026-825825.3An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retriev
CVE-2026-82560: High severity, CVSS 7.5 | Vulnix