CVE-2026-82560

Publication date 19 September 2026

Last updated 11 November 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

7.5 · High

Score breakdown

Description

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.

Status

Package Ubuntu Release Status
perl 26.10 stonking
Fixed in 5.42.3-1ubuntu0.1
26.04 LTS resolute
Fixed in 5.40.1-7ubuntu0.4
24.04 LTS noble
Fixed in 5.38.2-3.2ubuntu0.7
22.04 LTS jammy
Fixed in 5.34.0-3ubuntu1.10
20.04 LTS focal
Fixed in 5.30.0-9ubuntu0.5+esm5
18.04 LTS bionic
Fixed in 5.26.1-6ubuntu0.7+esm5
16.04 LTS xenial
Fixed in 5.22.1-9ubuntu0.9+esm5
14.04 LTS trusty
Fixed in 5.18.2-2ubuntu1.7+esm10

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Severity score breakdown

CVSS version: CVSS v3.0

Base score 7.5 · High

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Related Ubuntu Security Notices (USN)

Other references

Access our resources on patching vulnerabilities