CVE-2026-82560

Executive Summary

CVE-2026-82560 is a denial-of-service vulnerability in the Perl Pod::Text module affecting all versions before 6.1.1. The flaw occurs when Pod::Text formats an attacker-supplied POD document containing deeply or maliciously nested =over directives: each =over increases the text indent margin, and once the accumulated margin reaches or exceeds the configured output width, the wrap() line-splitting substitution matches the empty string and the loop appends padding indefinitely without consuming input. The result is an infinite loop that never returns and steadily exhausts both CPU and memory, leading to process termination or full host exhaustion in any service that renders untrusted POD content. Any application, CI pipeline, package indexer, documentation renderer, or web service that passes attacker-controlled POD to this module is affected. No public exploit, PoC, or Nuclei template is currently available, and no patch has been confirmed by tracked sources.

Technical Analysis

Pod::Text is a core Perl distribution module that converts POD ("Plain Old Documentation") markup into formatted plain text. POD uses paragraph directives — including =over, =item, and =back — to represent lists and indentation. The =over directive accepts a numeric argument specifying how many columns to indent the following block. Pod::Text maintains an accumulated left margin, and each nested =over adds its indent value to that margin.

Critically, the internal wrap() routine computes the space available for wrapping text as:

available = output_width - margin

When an attacker supplies a POD document with enough nested (or sufficiently large) =over directives, the accumulated margin meets or exceeds output_width. Because POD parsers generally do not enforce a sanity limit on nesting depth or cumulative indent, the computed available becomes zero or negative.

At that point, the line-splitting substitution inside wrap() — which is intended to break a line at whitespace within available characters — can match the empty string. A substitution that consumes zero input still succeeds, so the surrounding loop makes no forward progress: the input cursor does not advance, yet the loop body appends the margin's padding (the indent whitespace) on every iteration. The observable behaviour is a non-terminating loop producing unbounded output. As described by NVD: "the loop consumes no input while appending the margin padding on every pass," and "formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."

Vulnerability class: CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop), with a secondary resource-exhaustion effect. This is a classic unbounded-loop defect arising from an unvalidated numeric configuration (margin width) interacting with a zero-width match condition in a text-processing routine. There is no memory-corruption, injection, or privilege-escalation primitive here — the impact is strictly availability.

Attack surface: Any code path that calls Pod::Text (directly, or transitively via Pod::Man, perldoc, Pod::Simple-based consumers that reuse this logic, documentation build systems, or web-based POD viewers) against data an adversary can influence. The attack requires only that the target format an attacker-controlled POD document. No authentication or special privileges are implied by the description.

Trigger preconditions (derivable from the description):

1. A POD document containing nested =over directives.
2. Accumulated margin meeting the output width used by the target invocation.
3. A code path that calls into Pod::Text's formatting/wrapping logic with that document.

No specific function, parameter, or file path beyond wrap() and the =over directive is named in the source data; other implementation identifiers are intentionally omitted.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for this CVE. The exploitation chain below is inferred strictly from the vulnerability class (CWE-835) and the behaviour described in the NVD entry. It does not assert implementation details beyond those stated.

No public PoC available; attack chain is inferred from vulnerability class.

1) Reconnaissance / target identification. An adversary identifies a service or pipeline that renders POD documents supplied by users. Candidate targets include web documentation portals or paste/view services that accept POD, CI/CD jobs that build POD documentation from contributions (e.g., pull requests to a repository containing .pod/.pm files), package-index or man-page renderers, and any API endpoint whose input is converted by Pod::Text. Reconnaissance is passive: the attacker only needs to determine that input in POD format is accepted and formatted.

2) Triggering the specific flaw class. The attacker crafts a POD document whose =over nesting or indent values are large enough that the cumulative margin equals or exceeds the target's output width. Repeatedly nesting =over (or supplying very large =over numeric arguments) drives the margin upward. When the available wrapping width reaches zero, the wrap() substitution matches the empty string, producing a loop that makes no progress.

3) Payload / execution method (vulnerability-class level). The payload is the malicious POD document itself — no code execution is required. It is delivered through whatever input channel the target exposes (upload field, HTTP request body, committed source file processed by CI, or a documentation queue). Because the defect is a non-terminating loop with unbounded output, no shellcode, gadget chain, or injection technique is involved; the "payload" is purely data that satisfies the nesting/width condition.

4) Post-exploitation impact. The affected process enters an infinite loop and its output buffer grows without bound. CPU is pinned and memory consumption rises until the process is OOM-killed or the host incurs pressure. In multi-tenant or shared CI runners, a single malicious document can starve other jobs. In a web service, repeated requests can exhaust the worker pool, resulting in a denial of service for all users. There is no persistence, data theft, or lateral movement implied by the described mechanism.

Impact Assessment

CVSS basis. No official CVSS score is assigned (NVD score: N/A); the vector above — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — reflects the description's implications: a network-reachable attack (AV:N) requiring no privileges (PR:N) or user interaction (UI:N) with low complexity (AC:L), producing a high availability impact (A:H) and no confidentiality or integrity impact. This vector is a reasoned estimate and not an authoritative vendor/NVD score.

Business impact. Denial of service against any service or build system that formats untrusted POD. Because POD processing is common in documentation toolchains, package build systems, and Perl-centric web applications, the blast radius depends on exposure of such processing paths to untrusted input.

Affected systems. Perl installations bundling Pod::Text before 6.1.1 — which is effectively any Perl distribution whose bundled module version predates the fix. Precise package inventories were not available from tracked sources (OSV packages: N/A; affected versions list: empty).

Blast radius. Single-process impact per crafted document; amplification is possible by submitting multiple documents concurrently, competing for the same CPU/memory resources. No evidence of autonomous propagation or worm behaviour.

Detection Guidance

Detection content below targets the behavioural signature (sustained CPU + growing memory during POD formatting, unusually nested =over input) rather than a specific exploit, since no public PoC exists.

Sigma Rule

title: Potential Pod::Text CVE-2026-82560 Denial of Service
id: 7c1f2a64-9b3e-4d2f-9f01-cve26082560
status: experimental
description: Detects processes rendering POD content that exhibit long-running CPU and memory growth consistent with Pod::Text =over margin exhaustion (CWE-835).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-82560
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection_bin:
    Image|endswith:
      - '/perl'
      - '/perldoc'
  selection_cmd:
    CommandLine|contains:
      - 'Pod::Text'
      - 'pod2text'
      - 'perldoc'
  condition: selection_bin and selection_cmd
  # Correlate with sustained high CPU > 60s and rising RSS for these processes
fields:
  - Image
  - CommandLine
  - ParentImage
falsepositives:
  - Legitimate large documentation builds
level: low

YARA Rule

rule CVE_2026_82560_Pod_Text_Over_Nesting
{
    meta:
        description = "Detects POD documents with excessive/high-value =over nesting that can drive Pod::Text wrap() margin to zero"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-82560"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $over = "=over" ascii nocase
        $bigover = /=\s*over\s+[0-9]{4,}/ ascii nocase

    condition:
        filesize < 5MB and
        (
            #over >= 24 or
            $bigover
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82560 Pod::Text =over margin exhaustion attempt"; flow:established,to_server; http.request_body; content:"=over"; nocase; fast_pattern; pcre:"/=over\s+[0-9]{4,}/iR"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-dos; sid:2608256001; rev:1;)

Note: This rule approximates the trigger using the only directive named in the source data (=over). Deep-nesting detection over HTTP bodies is inherently heuristic; tune the count/threshold and inspect for high-value =over arguments.

Elastic Detection

// Detect Pod::Text formatting runs that persist abnormally long (possible infinite loop)
process where process.name in ("perl", "perldoc", "pod2text")
  and process.args : "*Pod::Text*"
  and process.runtime_ns / 1000000000 > 120

Additionally, correlate memory growth using metrics:

metrics where process.name : "perl"
  and process.runtime_ns / 1000000000 > 120
  and system.process.memory.rss.bytes > 500000000

Splunk SPL Query

index=os sourcetype=ps OR sourcetype=top
| search process_name IN ("perl","perldoc","pod2text") OR command_line="*Pod::Text*"
| stats max(cpu_percent) AS cpu max(mem_percent) AS mem by host process_name pid
| where cpu > 95 AND mem > 50
| table host process_name pid cpu mem

Process-execution oriented variant:

index=endpoint sourcetype=*:Process:* 
| search (process_name="perl" OR process_name="perldoc") 
| search command_line="*Pod::Text*" OR command_line="*pod2text*"
| stats count earliest(_time) AS first latest(_time) AS last by host process_id
| eval duration=last-first 
| where duration > 120

Wazuh OSSEC Rule

<group name="cve_2026_82560,pod_text,dos,">
  <rule id="2608256" level="10">
    <if_sid>5501</if_sid>
    <field name="command">perl|perldoc|pod2text</field>
    <match>Pod::Text|pod2text|=over</match>
    <description>CVE-2026-82560: Potential Pod::Text =over margin exhaustion (CWE-835) denial of service attempt detected.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,availability,</group>
  </rule>

  <rule id="2608257" level="12">
    <if_sid>2608256</if_sid>
    <field name="cpu_usage">^9[0-9]$|^100$</field>
    <description>CVE-2026-82560: Pod::Text process pinned at high CPU with sustained runtime — likely infinite wrap() loop.</description>
    <group>dos,availability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, commit reference, vendor advisory, or fixed-package signal was returned by any tracked source. The NVD description identifies Pod::Text 6.1.1 as the version in which the issue is resolved (versions before 6.1.1 are affected), but no authoritative vendor fix record is available to confirm the exact change. Treat all installations of Pod::Text below 6.1.1 as vulnerable until validated against upstream.

1) Immediate mitigations

• Never pass attacker-controlled or untrusted POD content to Pod::Text or any renderer that uses it.
• Apply resource limits around any POD-formatting process: CPU time limits (ulimit -t), address-space/memory limits (ulimit -v), and wall-clock timeouts on subprocesses and worker jobs.
• Sanitize or pre-validate POD input: cap the count of =over directives and reject/large-clamp =over numeric arguments before formatting.
• In CI/CD, gate documentation-build jobs on trusted contributors only, or run them in isolated, resource-capped containers so a single malicious document cannot starve the runner pool.
• For web services accepting POD, enforce input size limits and per-request timeouts, and isolate the formatting step from the main application process.

2) Patch / upgrade steps

• Upgrade Pod::Text to 6.1.1 or later where it is available from upstream. Because no patch source is confirmed by tracked data, verify the fixed version against the CPAN/upstream Pod::Text distribution and your Perl core distribution before relying on it.
• Where the module is bundled with Perl core, track the corresponding Perl release that ships Pod::Text 6.1.1+ or update the module independently (e.g., via a locally vendored/patched distribution).
• Re-test any POD-processing path after upgrade using a document with extreme =over nesting to confirm the loop no longer occurs.

3) Long-term hardening

• Add automated regression tests that feed pathological POD (deep/high-value =over nesting) and assert bounded runtime/output.
• Enforce input-validation policy for any markup rendered by third-party libraries: bound nesting depth, indent magnitude, and total output size.
• Adopt universal subprocess sandboxing (cgroups, containers, timeouts) for all document-conversion tooling.
• Monitor for the behavioural signature (high CPU + growing RSS during formatting) and alert on it as a defense-in-depth measure.

References

1. NVD — CVE-2026-82560: https://nvd.nist.gov/vuln/detail/CVE-2026-82560
2. CWE-835 — Loop with Unreachable Exit Condition ('Infinite Loop'): https://cwe.mitre.org/data/definitions/835.html
3. MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
4. Perl / CPAN — Pod::Text module distribution (verify current fixed version, referenced as 6.1.1 in the NVD description): https://metacpan.org/pod/Pod::Text
5. FIRST EPSS — not yet scored for this CVE: https://www.first.org/epss/

Exploit-in-the-wild / threat actor note: None. No public PoC, exploit code, or Nuclei template is available; CISA KEV status is NO. No known threat-actor campaign or exploitation evidence was identified in the provided data.