Summary
It was discovered that Pod::Text in Perl did not properly handle POD
documents with deeply nested =over directives. If a user or automated
system were tricked into processing a specially crafted file, an
attacker could possibly use this issue to cause CPU and memory
exhaustion, resulting in a denial of service.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | perl | 5.34.0-3ubuntu1.10 |
| Ubuntu · 24.04 LTS 24.04:LTS | perl | 5.38.2-3.2ubuntu0.7 |
| Ubuntu · 26.04 LTS 26.04:LTS | perl | 5.40.1-7ubuntu0.4 |
| Ubuntu · 26.10 | perl | 5.42.3-1ubuntu0.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | perl | 5.18.2-2ubuntu1.7+esm10 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | perl | 5.22.1-9ubuntu0.9+esm5 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | perl | 5.26.1-6ubuntu0.7+esm5 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | perl | 5.30.0-9ubuntu0.5+esm5 |
Vulnerabilities 1
-
High 7.5
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the spa…
References
-
report
https://ubuntu.com/security/CVE-2026-82560