« Volver al listado

CVE-2026-82560

Estado: AplazadaAlta (7.5)—

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.

Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.

Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Pod::Text expuesta a documentos POD malformados causa DoS por bucle infinito y consumo de memoria/CPU; AV:N sin autenticación confirma T1190.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Perl — POD TextAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-82560",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-82560",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-21T18:38:28.024702Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "repo": "https://github.com/rra/podlators",
          "modules": [
            "Pod::Text"
          ],
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "6.1.1",
              "versionType": "custom"
            }
          ],
          "packageURL": "pkg:cpan/podlators",
          "packageName": "podlators",
          "programFiles": [
            "lib/Pod/Text.pm",
            "lib/Pod/Text/Color.pm",
            "lib/Pod/Text/Overstrike.pm",
            "lib/Pod/Text/Termcap.pm"
          ],
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "Pod::Text::wrap"
            },
            {
              "name": "Pod::Text::Color::wrap"
            },
            {
              "name": "Pod::Text::Overstrike::wrap"
            },
            {
              "name": "Pod::Text::Termcap::wrap"
            }
          ]
        },
        {
          "repo": "https://github.com/Perl/perl5",
          "modules": [
            "Pod::Text"
          ],
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "5.45.2"
            }
          ],
          "packageURL": "pkg:cpan/perl",
          "packageName": "perl",
          "programFiles": [
            "cpan/podlators/lib/Pod/Text.pm",
            "cpan/podlators/lib/Pod/Text/Color.pm",
            "cpan/podlators/lib/Pod/Text/Overstrike.pm",
            "cpan/podlators/lib/Pod/Text/Termcap.pm"
          ],
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "Pod::Text::wrap"
            },
            {
              "name": "Pod::Text::Color::wrap"
            },
            {
              "name": "Pod::Text::Overstrike::wrap"
            },
            {
              "name": "Pod::Text::Termcap::wrap"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-09-19T16:16:32.140",
  "references": [
    {
      "url": "https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/RRA/podlators-v6.1.1/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/09/19/6",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."
    }
  ],
  "lastModified": "2026-09-22T19:07:00.983",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
}