CVE-2026-82560: Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width

Pod::Text versions before 6.1.1 contain an infinite loop (CWE-835) in its POD formatting logic: each =over directive adds its indent to the margin, and wrap() subtracts that margin from the output width to determine the space available for text. When enough nesting drives the available space to zero, the line-splitting substitution matches the empty string, so the loop consumes no input while appending margin padding on every pass. An attacker who can supply a crafted POD document to a tool or service that formats it gains an immediate denial of service: formatting never returns and the growing output exhausts memory. Any Perl application or toolchain that renders untrusted POD with Pod::Text (documentation converters, perldoc-style viewers, services accepting POD input) is affected, while hosts that only format trusted local documentation carry the vulnerable code but are not readily exploitable. No public PoC exists, the issue is not in CISA KEV, no exploitation is known, and CVSS has not yet been scored.

Do: Upgrade Pod::Text to 6.1.1 or later. Until patched, cap =over nesting depth or reject untrusted POD documents whose nesting could push the margin to the output width, and audit any service (pod2text, perldoc-style viewers, POD-to-text/HTML converters) that renders user-supplied POD.