PatchSiren cyber security CVE debrief

CVE-2026-8594 NEZUMI CVE debrief

A flaw in Text::LineFold (part of the Unicode-LineBreak distribution for Perl) causes input duplication when special break characters are present. The module splits input on characters such as VT and FF into segments, but incorrectly applies the break function to the entire original string rather than to each segment individually. As a result, the full input is duplicated once per segment, which can drive unexpected resource consumption and denial of service. Versions through 2019.001 are affected.

Vendor: NEZUMI
Product: Text::LineFold
CVSS: MEDIUM 6.2
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-30
Original CVE updated: 2026-07-22
Advisory published: 2026-05-30
Advisory updated: 2026-07-22

Who should care

Teams running Perl applications that process untrusted text through Text::LineFold or the Unicode-LineBreak distribution, especially services handling bulk user content or automated document pipelines.

Technical summary

Text::LineFold in Unicode-LineBreak ≤2019.001 splits input on special break characters (VT, FF, etc.) into segments, then erroneously runs the break routine against the whole input string for each segment. This causes the full input to be duplicated per segment, leading to superlinear growth in output size and potential denial of service through memory/CPU exhaustion. The issue is local in attack vector per CVSS (AV:L) and requires no privileges or user interaction.

Defensive priority

medium

Recommended defensive actions

Upgrade Unicode-LineBreak/Text::LineFold to a fixed version when available; apply the vendor patch (CVE-2026-8594-r1) if running version 2019.001 or earlier.
Review applications that pass untrusted or large input to Text::LineFold and consider input sanitization or length limits as a temporary control.
Monitor the Unicode-LineBreak distribution on CPAN for an updated release that resolves the incorrect segment handling.

Evidence notes

The NVD record (modified 2026-06-01) lists CVSS 6.2 (MEDIUM) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and weaknesses CWE-405 (Asymmetric Resource Consumption) and CWE-407 (Inefficient Algorithmic Complexity). The oss-security mailing list post (2026-05-30) and a GitHub pull request are cited as references. A patch is available via security.metacpan.org.

Sources and references

Verified primary and authoritative sources

CVE-2026-8594 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-8594

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-8594 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8594

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://github.com/hatukanezumi/Unicode-LineBreak/pull/6

9b29abf9-4ab0-4765-b253-1875cd9b441e
Source reference
Unverified legacy reference

URL: https://metacpan.org/release/NEZUMI/Unicode-LineBreak-2019.001/source/lib/Text/LineFold.pm

9b29abf9-4ab0-4765-b253-1875cd9b441e
Source reference
Unverified legacy reference

URL: https://security.metacpan.org/patches/U/Unicode-LineBreak/2019.001/CVE-2026-8594-r1.patch

9b29abf9-4ab0-4765-b253-1875cd9b441e

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.