The NEZUMI Text::LineFold Perl module up to version 2019.001 contains a vulnerability (CVE-2026-8594) related to improper handling of line break characters during string processing. Specifically, the module splits input by special break characters but applies the break function globally rather than per segment, causing the entire input to be duplicated multiple times. This results in asymmetric resource consumption (amplification), which can cause unexpected high memory or CPU usage and potentially lead to denial of service conditions. The vulnerability is categorized under CWE-405 (Asymmetric Resource Consumption) and CWE-407 (Improper Resource Shutdown or Release). The module is part of the Unicode-LineBreak distribution, which may have different versioning. No patch or official fix has been documented.

The vulnerability can cause excessive resource consumption when processing specially crafted input containing multiple special line break characters. This may lead to denial of service by exhausting system resources such as memory or CPU. There are no reports of active exploitation in the wild. The impact is limited to applications using the affected versions of the Text::LineFold module in Perl environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding processing untrusted input with affected versions of Text::LineFold or implement input validation to limit the number of special break characters. Monitoring for updates from the NEZUMI project or CPAN security advisories is recommended.