« Volver al listado

CVE-2026-8594

Estado: AplazadaMedia (6.2)—

Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.

Text::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment.

A side effect of this is that the full input can be duplicated for each segment. Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service.

Note that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Perl — Text LinefoldAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-8594",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-8594",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-01T15:06:26.879298Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.2,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "repo": "https://github.com/hatukanezumi/Unicode-LineBreak/",
          "vendor": "NEZUMI",
          "product": "Text::LineFold",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2019.001"
            }
          ],
          "packageName": "Unicode-LineBreak",
          "programFiles": [
            "lib/Text/LineFold.pm"
          ],
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "Text::LineFold::fold"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-30T16:17:05.067",
  "references": [
    {
      "url": "https://github.com/hatukanezumi/Unicode-LineBreak/pull/6",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/NEZUMI/Unicode-LineBreak-2019.001/source/lib/Text/LineFold.pm#L407-415",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://security.metacpan.org/patches/U/Unicode-LineBreak/2019.001/CVE-2026-8594-r1.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/05/30/6",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "description": [
        {
          "lang": "en",
          "value": "CWE-405"
        },
        {
          "lang": "en",
          "value": "CWE-407"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.\n\nText::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment.\n\nA side effect of this is that the full input can be duplicated for each segment.  Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service.\n\nNote that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module."
    },
    {
      "lang": "es",
      "value": "Las versiones de Text::LineFold hasta la 2019.001 para Perl duplican la salida basándose en el número de caracteres de salto especiales.\n\nText::LineFold divide la cadena de entrada por caracteres de salto de línea específicos (como VT, FF y otros) en segmentos, pero aplica la función de salto a la cadena completa, no solo al segmento.\n\nUn efecto secundario de esto es que la entrada completa puede duplicarse para cada segmento. Además de ser incorrecto, esto puede llevar a un consumo inesperado de recursos y una posible denegación de servicio.\n\nTenga en cuenta que Text::LineFold forma parte de la distribución Unicode-LineBreak, la cual puede tener un número de versión superior al del módulo."
    }
  ],
  "lastModified": "2026-07-22T07:10:00.107",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
}