{"id":"CVE-2026-110752","aliases":["AZL-109745","DEBIAN-CVE-2026-110752","EUVD-2026-103192","GHSA-c8hf-63cr-rrfm","MGASA-2026-0563","SUSE-SU-2026:5120-1","UBUNTU-CVE-2026-110752","openSUSE-SU-2026:12218-1"],"status":"published","title":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment","description":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.\n\nfragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements.\n\nAn application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00408,"percentile":0.35385,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-10-16T22:06:03Z","modified":"2026-11-06T12:30:03Z","fixes":[{"ecosystem":"Debian:14","package":"libtext-csv-xs-perl","fixed_in":["1.65-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.60-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.49-1","1.49-1+deb12u1","1.50-1","1.51-1","1.52-1","1.53-1","1.54-1","1.55-1","1.56-1","1.57-1","1.59-1","1.60-1","1.61-1","1.62-1","1.64-1","1.65-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60-1","1.60-1+deb13u1","1.61-1","1.62-1","1.64-1","1.65-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.65-1"}]}],"versions":["1.60-1","1.61-1","1.62-1","1.64-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.650.0-1.mga10"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19-1","1.20-1","1.20-1build1","1.21-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26-1build1","1.34-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.39-1","1.39-1build1","1.40-1","1.41-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.45-1","1.46-1","1.47-1","1.47-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.51-1","1.52-1","1.53-1","1.53-1build1","1.53-1build2","1.53-1build3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.61-1","1.62-1","1.64-1","1.64-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60-1","1.61-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.650.0-1.1"}]}],"bundled":8}],"references":[{"url":"https://github.com/cpan-authors/Text-CSV_XS/commit/d9d3d66f9ff6a8a1bc255a6ef05100f9b102b92b.patch","tags":["patch","fix"]},{"url":"https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes","tags":["release-notes","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110752","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-c8hf-63cr-rrfm"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110752.json","tags":["advisory"]},{"url":"https://github.com/cpan-authors/Text-CSV_XS","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-110752","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0563.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36532","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/16/38","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265120-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1286128","tags":["report"]},{"url":"https://bugzilla.suse.com/1286130","tags":["report"]},{"url":"https://bugzilla.suse.com/1286137","tags":["report"]},{"url":"https://bugzilla.suse.com/1286138","tags":["report"]},{"url":"https://bugzilla.suse.com/1286188","tags":["report"]},{"url":"https://bugzilla.suse.com/1286191","tags":["report"]},{"url":"https://bugzilla.suse.com/1286198","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110759","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-110752","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110752","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/44408679/","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110753","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-110752","title":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment","description":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.\n\nfragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements.\n\nAn application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.","status":"published","published":"2026-10-16T22:06:03.622Z","modified":"2026-10-20T18:12:38.953Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:34:26.24368Z"}],"euvd":[{"id":"EUVD-2026-103192","description":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.\n\nfragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements.\n\nAn application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.","status":"published","published":"2026-10-16T22:06:03Z","modified":"2026-10-20T18:12:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:43.145678Z"}],"ghsa":[{"id":"GHSA-c8hf-63cr-rrfm","title":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per...","description":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.\n\nfragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements.\n\nAn application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.","status":"published","published":"2026-10-17T00:31:19Z","modified":"2026-10-20T21:30:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:14:04.750771Z"}],"nvd":[{"id":"CVE-2026-110752","description":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.\n\nfragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements.\n\nAn application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.","status":"published","published":"2026-10-16T23:17:00.41Z","modified":"2026-10-20T19:17:29.383Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:13:00.123071Z"}],"osv":[{"id":"CVE-2026-110752","title":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment","description":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.\n\nfragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements.\n\nAn application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.","status":"published","published":"2026-10-16T22:06:03.622Z","modified":"2026-11-06T12:41:57.708726557Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-06T13:13:39.297328Z"},{"id":"DEBIAN-CVE-2026-110752","description":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.  fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements.  An application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.","status":"published","published":"2026-10-16T23:17:00.41Z","modified":"2026-10-23T18:02:33.525962714Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:49.824149Z"},{"id":"UBUNTU-CVE-2026-110752","description":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements. An application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.","status":"published","published":"2026-10-16T23:17:00Z","modified":"2026-10-28T20:17:18.332588337Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:59.591851Z"},{"id":"AZL-109745","title":"CVE-2026-110752 affecting package perl-Text-CSV_XS 1.60-1","description":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.\n\nfragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements.\n\nAn application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.","status":"published","published":"2026-10-16T23:17:00Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.42484Z"},{"id":"MGASA-2026-0563","title":"Updated perl-Text-CSV_XS package fixes security vulnerabilities","description":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by\nallocating one entry per index of an RFC 7111 selector in fragment.\n(CVE-2026-110752)\nText::CSV_XS versions from 1.46 before 1.65 for Perl have a\nuse-after-free of bind_columns variables when skip_empty_rows skips an\nempty line in getline. (CVE-2026-110753)\nText::CSV_XS versions before 1.65 for Perl leak the parsed fields of a\nrecord that fails to parse in getline. (CVE-2026-110754)\nText::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by\ncopying the unparsed remainder per record of CR-only input in getline.\n(CVE-2026-110755)\nText::CSV_XS versions before 1.65 for Perl drop the end of a record and\nits line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes\nin print. (CVE-2026-110756)\nText::CSV_XS versions before 1.65 for Perl allow record splitting by\nwriting strings used as numbers without quotes in combine.\n(CVE-2026-110757)\nText::CSV_XS versions before 1.65 for Perl read before the start of an\nall-blank field under allow_whitespace in strip_trail_whitespace.\n(CVE-2026-110758)\nText::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is\nnot in the input for an empty last field followed by a lone CR in parse.\n(CVE-2026-110759)\n","status":"published","published":"2026-10-28T02:10:00Z","modified":"2026-10-28T02:15:04.96411964Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12218-1","title":"perl-Text-CSV_XS-1.650.0-1.1 on GA media","description":"These are all security issues fixed in the perl-Text-CSV_XS-1.650.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-21T00:00:00Z","modified":"2026-10-22T17:23:11.300589166Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:5120-1","title":"Security update for perl-Text-CSV_XS","description":"This update for perl-Text-CSV_XS fixes the following issues:\n\n- CVE-2026-110752: unclamped RFC 7111 selector range pre-allocation in fragment() can cause memory exhaustion via large\n  index ranges (bsc#1286138).\n- CVE-2026-110754: unfreed field array memory leak on getline() syntax errors can lead to process memory exhaustion via\n  malformed CSV input (bsc#1286188).\n- CVE-2026-110755: quadratic buffer copying overhead during CR-only line parsing in getline() can cause CPU exhaustion\n  and denial of service (bsc#1286198).\n- CVE-2026-110756: invalid UTF-8 bytes during buffer flushes in print() can cause silent field truncation (bsc#1286130).\n- CVE-2026-110757: unquoted writing of numeric-flagged strings containing newlines in combine() and print() can cause\n  record splitting and row injection (bsc#1286191).\n- CVE-2026-110758: missing buffer start boundary check in strip_trail_whitespace under allow_whitespace can cause heap\n  out-of-bounds read and memory corruption (bsc#1286137).\n- CVE-2026-110759: improper end-of-file marker handling after a lone CR can cause Text::CSV_XS to inject an unexpected\n  0xFF byte (bsc#1286128).\n","status":"published","published":"2026-11-05T12:19:29Z","modified":"2026-11-06T12:30:03.490751417Z","updated_at":"2026-11-06T12:43:06.926783Z"}]}}