{"id":"CVE-2026-110754","aliases":["AZL-109763","DEBIAN-CVE-2026-110754","EUVD-2026-103194","GHSA-v7vg-mqfq-633j","MGASA-2026-0563","SUSE-SU-2026:5120-1","UBUNTU-CVE-2026-110754","openSUSE-SU-2026:12218-1"],"status":"published","title":"Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline","description":"Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline.\n\ngetline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error.\n\nA long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00302,"percentile":0.23122,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401"],"published":"2026-10-16T22:06:46Z","modified":"2026-11-06T12:30:03Z","fixes":[{"ecosystem":"Debian:14","package":"libtext-csv-xs-perl","fixed_in":["1.65-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.60-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.49-1","1.49-1+deb12u1","1.50-1","1.51-1","1.52-1","1.53-1","1.54-1","1.55-1","1.56-1","1.57-1","1.59-1","1.60-1","1.61-1","1.62-1","1.64-1","1.65-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60-1","1.60-1+deb13u1","1.61-1","1.62-1","1.64-1","1.65-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.65-1"}]}],"versions":["1.60-1","1.61-1","1.62-1","1.64-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.650.0-1.mga10"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19-1","1.20-1","1.20-1build1","1.21-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26-1build1","1.34-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.39-1","1.39-1build1","1.40-1","1.41-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.45-1","1.46-1","1.47-1","1.47-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.51-1","1.52-1","1.53-1","1.53-1build1","1.53-1build2","1.53-1build3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.61-1","1.62-1","1.64-1","1.64-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60-1","1.61-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.650.0-1.1"}]}],"bundled":8}],"references":[{"url":"https://github.com/cpan-authors/Text-CSV_XS/commit/eb4f739ffc605bfb1ab710e5330704faa0e89f08.patch","tags":["patch","fix"]},{"url":"https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes","tags":["release-notes","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110754","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-v7vg-mqfq-633j"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110754.json","tags":["advisory"]},{"url":"https://github.com/cpan-authors/Text-CSV_XS","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-110754","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0563.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36532","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/16/38","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265120-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1286128","tags":["report"]},{"url":"https://bugzilla.suse.com/1286130","tags":["report"]},{"url":"https://bugzilla.suse.com/1286137","tags":["report"]},{"url":"https://bugzilla.suse.com/1286138","tags":["report"]},{"url":"https://bugzilla.suse.com/1286188","tags":["report"]},{"url":"https://bugzilla.suse.com/1286191","tags":["report"]},{"url":"https://bugzilla.suse.com/1286198","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110759","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-110754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110754","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/44408685/","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110753","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-110754","title":"Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline","description":"Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline.\n\ngetline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error.\n\nA long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.","status":"published","published":"2026-10-16T22:06:46.839Z","modified":"2026-10-20T18:15:41.395Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T13:34:37.420074Z"}],"euvd":[{"id":"EUVD-2026-103194","description":"Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline.\n\ngetline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error.\n\nA long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.","status":"published","published":"2026-10-16T22:06:46Z","modified":"2026-10-20T18:15:41Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:59:43.145678Z"}],"ghsa":[{"id":"GHSA-v7vg-mqfq-633j","title":"Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse...","description":"Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline.\n\ngetline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error.\n\nA long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.","status":"published","published":"2026-10-17T00:31:19Z","modified":"2026-10-20T21:30:43Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:14:04.750771Z"}],"nvd":[{"id":"CVE-2026-110754","description":"Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline.\n\ngetline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error.\n\nA long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.","status":"published","published":"2026-10-16T23:17:00.637Z","modified":"2026-10-20T19:17:29.7Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:13:00.123071Z"}],"osv":[{"id":"CVE-2026-110754","title":"Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline","description":"Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline.\n\ngetline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error.\n\nA long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.","status":"published","published":"2026-10-16T22:06:46.839Z","modified":"2026-11-06T12:41:58.921892544Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-401"],"updated_at":"2026-11-06T13:13:26.765116Z"},{"id":"DEBIAN-CVE-2026-110754","description":"Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline.  getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error.  A long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.","status":"published","published":"2026-10-16T23:17:00.637Z","modified":"2026-10-23T18:05:32.278876067Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:49.824149Z"},{"id":"UBUNTU-CVE-2026-110754","description":"Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error. A long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.","status":"published","published":"2026-10-16T23:17:00Z","modified":"2026-10-28T20:17:41.542673038Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:59.591851Z"},{"id":"AZL-109763","title":"CVE-2026-110754 affecting package perl-Text-CSV_XS 1.60-1","description":"Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline.\n\ngetline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error.\n\nA long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.","status":"published","published":"2026-10-16T23:17:00Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.42484Z"},{"id":"MGASA-2026-0563","title":"Updated perl-Text-CSV_XS package fixes security vulnerabilities","description":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by\nallocating one entry per index of an RFC 7111 selector in fragment.\n(CVE-2026-110752)\nText::CSV_XS versions from 1.46 before 1.65 for Perl have a\nuse-after-free of bind_columns variables when skip_empty_rows skips an\nempty line in getline. (CVE-2026-110753)\nText::CSV_XS versions before 1.65 for Perl leak the parsed fields of a\nrecord that fails to parse in getline. (CVE-2026-110754)\nText::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by\ncopying the unparsed remainder per record of CR-only input in getline.\n(CVE-2026-110755)\nText::CSV_XS versions before 1.65 for Perl drop the end of a record and\nits line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes\nin print. (CVE-2026-110756)\nText::CSV_XS versions before 1.65 for Perl allow record splitting by\nwriting strings used as numbers without quotes in combine.\n(CVE-2026-110757)\nText::CSV_XS versions before 1.65 for Perl read before the start of an\nall-blank field under allow_whitespace in strip_trail_whitespace.\n(CVE-2026-110758)\nText::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is\nnot in the input for an empty last field followed by a lone CR in parse.\n(CVE-2026-110759)\n","status":"published","published":"2026-10-28T02:10:00Z","modified":"2026-10-28T02:15:04.96411964Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12218-1","title":"perl-Text-CSV_XS-1.650.0-1.1 on GA media","description":"These are all security issues fixed in the perl-Text-CSV_XS-1.650.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-21T00:00:00Z","modified":"2026-10-22T17:23:11.300589166Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:5120-1","title":"Security update for perl-Text-CSV_XS","description":"This update for perl-Text-CSV_XS fixes the following issues:\n\n- CVE-2026-110752: unclamped RFC 7111 selector range pre-allocation in fragment() can cause memory exhaustion via large\n  index ranges (bsc#1286138).\n- CVE-2026-110754: unfreed field array memory leak on getline() syntax errors can lead to process memory exhaustion via\n  malformed CSV input (bsc#1286188).\n- CVE-2026-110755: quadratic buffer copying overhead during CR-only line parsing in getline() can cause CPU exhaustion\n  and denial of service (bsc#1286198).\n- CVE-2026-110756: invalid UTF-8 bytes during buffer flushes in print() can cause silent field truncation (bsc#1286130).\n- CVE-2026-110757: unquoted writing of numeric-flagged strings containing newlines in combine() and print() can cause\n  record splitting and row injection (bsc#1286191).\n- CVE-2026-110758: missing buffer start boundary check in strip_trail_whitespace under allow_whitespace can cause heap\n  out-of-bounds read and memory corruption (bsc#1286137).\n- CVE-2026-110759: improper end-of-file marker handling after a lone CR can cause Text::CSV_XS to inject an unexpected\n  0xFF byte (bsc#1286128).\n","status":"published","published":"2026-11-05T12:19:29Z","modified":"2026-11-06T12:30:03.490751417Z","updated_at":"2026-11-06T12:43:06.926783Z"}]}}