Skip to content
OpenAdvisories
Medium · 6.2 CVE-2026-8594 EUVD-2026-33466GHSA-xfcf-wwr2-w555

Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters

Published May 30, 2026 · Updated Jun 1, 2026 · Assigned by CPANSec

Description

Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.

Text::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment.

A side effect of this is that the full input can be duplicated for each segment. Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service.

Note that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.

Affected products

VendorProductAffectedFixed
NEZUMI Text::LineFold ≤ 2019.001 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libunicode-linebreak-perl 0.0.20190101-4 —
Debian 13 libunicode-linebreak-perl No fix yet —
Debian 12 libunicode-linebreak-perl No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 libunicode-linebreak-perl No fix yet —
Ubuntu 26.04 LTS libunicode-linebreak-perl No fix yet —
Ubuntu 25.10 libunicode-linebreak-perl No fix yet —
Ubuntu 24.04 LTS libunicode-linebreak-perl No fix yet —
Ubuntu 22.04 LTS libunicode-linebreak-perl No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS libunicode-linebreak-perl No fix yet —
Ubuntu 18.04 LTS libunicode-linebreak-perl No fix yet —
Ubuntu 16.04 LTS libunicode-linebreak-perl No fix yet —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 perl-Unicode-LineBreak 2019.001-9.amzn2023.0.4 ALAS2023-2026-1831

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 perl-Unicode-LineBreak No fix yet —

Advisories 1

References