The NEZUMI Text::LineFold Perl module, up to version 2019.001, contains a vulnerability where the function that splits input strings by special line break characters (such as VT and FF) applies the break operation to the entire input string for each segment rather than just the segment itself. This results in duplication of the full input string multiple times, causing asymmetric resource consumption (amplification). This flaw can lead to excessive resource usage and potentially denial of service conditions. The vulnerability is tracked as CVE-2026-8594 with a CVSS 3.1 base score of 6.2 (medium severity). No patch or official fix has been documented in the vendor or advisory data.

The vulnerability causes the Text::LineFold module to consume excessive system resources by duplicating the entire input string multiple times during processing. This can lead to denial of service by exhausting memory or CPU resources on the affected system. There is no impact on confidentiality or integrity reported. Exploitation requires local access (AV:L) and no privileges are required (PR:N). No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting input sizes or avoiding use of the vulnerable Text::LineFold versions in security-sensitive contexts. Monitor vendor channels for updates or patches addressing this issue.