CVE-2026-82560
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.
Risk Assessment
An attacker can supply a specially crafted POD document, causing the application to hang and exhaust system resources (CPU and memory). This can lead to a denial of service (DoS) for applications processing POD documents.
Recommendation
Upgrade Pod::Text to version 6.1.1 or later. If upgrading is not possible, avoid processing untrusted POD documents or limit process resources (CPU and memory limits).
Related vulnerabilities
- CVE-2026-116232Critical
A weakness was identified in Oray Pugongying X5 Pro 7.6.1 affecting the snmp_set function of the SNMP Handler component. Manipulating the info.community argument can lead to CRLF injection. The attack can be launched remotely and a public exploit is available.
- CVE-2026-116231Critical
A security flaw was discovered in Oray Pugongying X5 Pro 7.6.1 in an unknown function of the Ser2net component. Manipulating the regmsg argument results in CRLF injection. The attack can be initiated remotely and the exploit has been publicly released.
- CVE-2026-116207Critical
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string, allowing subquery injection.
- CVE-2026-115995Critical
A vulnerability was detected in Unitree Robotics Unitree Go2 up to version 1.1.11.4. The set_volume function in gpt_thread.py of the chat_go component mishandles the Value argument, leading to OS command injection. The attack can be launched remotely, and upgrading to version 1.1.11.5 resolves the issue.
- CVE-2026-114820Critical
Vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It is easily exploitable by an unauthenticated attacker with network access, leading to unauthorized creation, deletion, or modification of critical data as well as unauthorized access to critical data. The vulnerability also applies to Java deployments that load and run untrusted code in a sandbox (e.g., Java Web Start applications or applets).
- CVE-2026-115933Critical
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back, allowing a user to obtain a validly signed token containing any claims they choose, accepted as a session, an organization invitation with a chosen role, a password reset or an enterprise provisioning token.
- CVE-2026-115557Critical
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
- CVE-2026-115932Critical
In Postiz, a media path that is not a web address is treated as a file on the server's disk without verifying it lies inside the upload directory. A registered user can store a crafted media path with a post and cause the publishing worker to read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads are reachable through two further routes, including file existence checks and backend memory exhaustion; self-registration is open by default.
- CVE-2026-94075Critical
The WordPress plugin Newsletters (newsletters-lite) up to version 4.18.1 contains a deserialization of untrusted data vulnerability, allowing object injection. This could enable an attacker to execute unintended code.
- CVE-2026-114196Critical
The WordPress plugin Paytium up to version 5.0.5 is vulnerable to deserialization of untrusted data, allowing object injection. This may enable an attacker to perform unauthorized actions.
Original NVD description (English source)
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS