Description
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.
Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.
Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | podlators | < 6.1.1 | 6.1.1 |
| — | perl | ≤ 5.45.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | perl | No fix yet | — |
| Debian 13 | perl | No fix yet | — |
| Debian 12 | perl | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | perl | 5.42.3-1ubuntu0.1 | USN-9006-1 |
| Ubuntu 26.04 LTS | perl | 5.40.1-7ubuntu0.4 | USN-9006-1 |
| Ubuntu 24.04 LTS | perl | 5.38.2-3.2ubuntu0.7 | USN-9006-1 |
| Ubuntu 22.04 LTS | perl | 5.34.0-3ubuntu1.10 | USN-9006-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | perl | 5.30.0-9ubuntu0.5+esm5 | USN-9006-1 |
| Ubuntu Pro 18.04 LTS | perl | 5.26.1-6ubuntu0.7+esm5 | USN-9006-1 |
| Ubuntu Pro 16.04 LTS | perl | 5.22.1-9ubuntu0.9+esm5 | USN-9006-1 |
| Ubuntu Pro 14.04 LTS | perl | 5.18.2-2ubuntu1.7+esm10 | USN-9006-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | perl-podlators | 1:4.14-458.amzn2023.0.3 | ALAS2023-2026-3399 |
| Amazon Linux 2 | perl-podlators | 2.5.1-3.amzn2.0.2 | ALAS2-2026-4080 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | perl | 5.38.2-517 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | perl | 5.44.0-r2 | — |
Advisories 4
- USN-9006-1 perl vulnerability Ubuntu Security Notices (USN) · Nov 11, 2026
- ALAS2023-2026-3399 Moderate: perl-podlators security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2-2026-4080 Moderate: perl-podlators security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- WID-SEC-2026-4312 IBM AIX und VIOS (Perl): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 3, 2026