Description
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.

Text::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment.

A side effect of this is that the full input can be duplicated for each segment. Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service.

Note that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.
Published: 2026-05-30
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability causes Text::LineFold to duplicate its entire output for every special line break encountered. This means that a single input string can be repeated many times, consuming excessive memory or CPU resources and producing incorrect results. The consequence is a potential denial of service when the module processes large or heavily segmented inputs.

Affected Systems

The module Text::LineFold, part of the NEZUMI Unicode-LineBreak distribution, is vulnerable in all releases up to and including version 2019.001. Systems relying on this module to process text containing VT, FF, or other Unicode line‑break characters are affected.

Risk and Exploitability

The defect can be triggered by supplying a crafted string with many special break characters to any component that uses Text::LineFold. An attacker could exploit this by sending such a string through user‑controlled input, causing the application to duplicate the full text and exhaust resources. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. No CVSS score is published, but the duplication can lead to significant resource exhaustion and service interruption.

Generated by OpenCVE AI on May 30, 2026 at 17:21 UTC.

Remediation

Vendor Workaround

Apply the patch.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch from https://security.metacpan.org/patches/U/Unicode-LineBreak/2019.001/CVE-2026-8594-r1.patch and rebuild the module.
  • Validate or bound the length of any text before it reaches Text::LineFold to limit duplication and resource consumption.
  • When possible, exclude the module from processing untrusted data, or replace it with a corrected implementation that does not duplicate output.

Generated by OpenCVE AI on May 30, 2026 at 17:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 30 May 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Nezumi
Nezumi text::linefold
Vendors & Products Nezumi
Nezumi text::linefold

Sat, 30 May 2026 19:30:00 +0000

Type Values Removed Values Added
References

Sat, 30 May 2026 16:00:00 +0000

Type Values Removed Values Added
Description Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters. Text::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment. A side effect of this is that the full input can be duplicated for each segment. Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service. Note that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.
Title Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters
Weaknesses CWE-405
CWE-407
References

Subscriptions

Nezumi Text::linefold
cve-icon MITRE

Status: PUBLISHED

Assigner: CPANSec

Published:

Updated: 2026-05-30T18:23:34.015Z

Reserved: 2026-05-14T11:54:55.248Z

Link: CVE-2026-8594

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-05-30T16:17:05.067

Modified: 2026-05-30T19:16:14.643

Link: CVE-2026-8594

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-30T21:17:24Z

Weaknesses