The vulnerability is a logic flaw in Pod::Text that causes unlimited CPU and memory consumption when processing an attacker-controlled POD document with deeply nested =over directives. This leads to denial of service. The flaw is categorized as CWE-835. The attacker can trigger resource exhaustion by sending a document that forces the margin calculation to zero, causing the formatting loop to append the margin endlessly without consuming input. The output grows until system memory or CPU cycles are exhausted, which can destabilize the application or host.

Pod::Text components bundled with Perl distributions are affected whenever the library version is earlier than 6.1.1. The vulnerability was identified in the bundled copy of podlators, which is used by many Perl setups. Affected versions include any Pod::Text package shipped before 6.1.1. The recommended fix is to upgrade to podlators 6.1.1 or later, which overrides the buggy bundled copy. This patch is available via the CPAN release RRA/podlators-v6.1.1.

No EPSS score is available and the vulnerability is not listed in CISA's KEV catalog, so the public exploitation risk is unknown. However, the flaw permits an attacker to subvert system resources by supplying a crafted POD document; the attack requires the ability to inject or influence the content processed by Pod::Text. In typical use cases, this is a local vulnerability but could be exposed through remote interfaces that accept POD input. Products with unpatched version may suffer from denial of service, which could lead to SLA violations or outages.