VulnSocial

CVE-2026-8594Disclosure

LOWCVSS 6.2 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters. Text::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment. A side effect of this is that the full input can be duplicated for each segment. Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service. Note that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-405CWE-407

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-05-30); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-05-30: 1Mentions · 2026-06-02: 1Technical Details · 2026-05-30: 1Technical Details · 2026-06-02: 105-3006-02
Signal classification1 categories
Disclosure
2100.0%
Referenced assets3 URLs
Full discourse2 posts
  • Open Source Security mailing list@oss_security
    Disclosure

    Perl CPAN CVE-2026-8594: Text::LineFold through 2019.001 duplicate the output based on the number of special break characters https://www.openwall.com/lists/oss-security/2026/05/30/6 CVE-2026-8796: Sereal::Decoder before 5.005 allow heap out-of-bounds read via crafted input https://www.openwall.com/lists/oss-security/2026/06/01/1

    Post summary

    The note lists two newly disclosed Perl CPAN CVEs, detailing a duplicate output flaw in Text::LineFold and a heap out‑of‑bounds read in Sereal::Decoder, with no PoC, exploit, patch or active exploitation information provided.

    00010205
    4.6K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-8594 Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters. Text::LineFold splits the input string by speci… https://www.cve.org/CVERecord?id=CVE-2026-8594

    Post summary

    The passage references CVE‑2026‑8594, describing how Text::LineFold duplicates output based on special break characters, without providing proof‑of‑concept, exploit, patch, or evidence of real‑world exploitation.

    00000126
    57.6K followersView on X

Explore more

Back to dashboard