AI analysis
Pod::Text versions before 6.1.1 contain an infinite loop (CWE-835) in its POD formatting logic: each =over directive adds its indent to the margin, and wrap() subtracts that margin from the output width to determine the space available for text. When enough nesting drives the available space to zero, the line-splitting substitution matches the empty string, so the loop consumes no input while appending margin padding on every pass. An attacker who can supply a crafted POD document to a tool or service that formats it gains an immediate denial of service: formatting never returns and the growing output exhausts memory. Any Perl application or toolchain that renders untrusted POD with Pod::Text (documentation converters, perldoc-style viewers, services accepting POD input) is affected, while hosts that only format trusted local documentation carry the vulnerable code but are not readily exploitable. No public PoC exists, the issue is not in CISA KEV, no exploitation is known, and CVSS has not yet been scored.
What to do: Upgrade Pod::Text to 6.1.1 or later. Until patched, cap =over nesting depth or reject untrusted POD documents whose nesting could push the margin to the output width, and audit any service (pod2text, perldoc-style viewers, POD-to-text/HTML converters) that renders user-supplied POD.
Affected
| Perl core (podlators) Pod::Text | All versions before 6.1.1 |
Estimated exposure
massmillions of Perl installations ship the vulnerable module (it is bundled with Perl itself), though only systems that format attacker-supplied POD are… — Pod::Text ships as part of the Perl core distribution, so essentially every host with Perl installed — millions of servers, workstations and CI systems — contains the vulnerable code.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.