{"id":"CVE-2026-7111","aliases":["AZL-85922","DEBIAN-CVE-2026-7111","EUVD-2026-26237","GHSA-29pg-8q2m-r6xm","MGASA-2026-0370","SUSE-SU-2026:1936-1","SUSE-SU-2026:21596-1","UBUNTU-CVE-2026-7111","openSUSE-SU-2026:10774-1","openSUSE-SU-2026:20708-1"],"status":"published","title":"Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption","description":"Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption.\n\nThe Parse, print, getline, and getline_all methods invoke registered callbacks (for example after_parse, before_print, or on_error) and cache the Perl argument stack pointer across the call. If a callback extends the argument stack enough to trigger a reallocation, the return value is written through the stale pointer into the freed buffer, and the caller reads the original $self argument as the return value instead.\n\nCalling code that expects parsed data from getline_all receives the Text::CSV_XS object in its place, leading to logic errors or crashes. Text::CSV_XS objects used without any registered callbacks are not affected.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00158,"percentile":0.04965,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416","CWE-825"],"published":"2026-04-29T14:22:29Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:12","package":"libtext-csv-xs-perl","fixed_in":["1.49-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libtext-csv-xs-perl","fixed_in":["1.60-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libtext-csv-xs-perl","fixed_in":["1.62-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"perl-Text-CSV_XS","fixed_in":["1.640.0-1.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-Text-CSV_XS","fixed_in":["1.640.0-1.mga9"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-Text-CSV_XS","fixed_in":["1.620.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.60-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.49-1+deb12u1"}]}],"versions":["1.49-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60-1+deb13u1"}]}],"versions":["1.60-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.62-1"}]}],"versions":["1.60-1","1.61-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.640.0-1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.640.0-1.mga9"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19-1","1.20-1","1.20-1build1","1.21-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26-1build1","1.34-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.39-1","1.39-1build1","1.40-1","1.41-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.45-1","1.46-1","1.47-1","1.47-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.51-1","1.52-1","1.53-1","1.53-1build1","1.53-1build2","1.53-1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.61-1","1.62-1","1.64-1","1.64-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60-1","1.61-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.620.0-1.1"}]}]}],"products":[{"vendor":"hmbrand","product":"text::csv_xs"},{"vendor":"hmbrand","product":"text\\"}],"references":[{"url":"https://github.com/cpan-authors/Text-CSV_XS/commit/c17f31a5f2bf36674748eb4b6e25672f0571a224.patch","tags":["patch","Mailing List","Patch","fix"]},{"url":"https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.62/changes","tags":["release-notes","Product","Release Notes","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/29/17","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/06/msg00037.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7111","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-29pg-8q2m-r6xm"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7111.json","tags":["advisory"]},{"url":"https://github.com/cpan-authors/Text-CSV_XS","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-7111","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0370.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35547","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/QELUJSCSNBIE4N5UNKH4YGI5LFCHEY65/","tags":["web"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/39453344/","tags":["web","report"]},{"url":"https://github.com/cpan-authors/Text-CSV_XS/issues/65","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261936-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1263690","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7111","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621596-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-7111","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7111","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-7111","title":"Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption","description":"Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption.\n\nThe Parse, print, getline, and getline_all methods invoke registered callbacks (for example after_parse, before_print, or on_error) and cache the Perl argument stack pointer across the call. If a callback extends the argument stack enough to trigger a reallocation, the return value is written through the stale pointer into the freed buffer, and the caller reads the original $self argument as the return value instead.\n\nCalling code that expects parsed data from getline_all receives the Text::CSV_XS object in its place, leading to logic errors or crashes. Text::CSV_XS objects used without any registered callbacks are not affected.","status":"published","published":"2026-04-29T14:22:29.358Z","modified":"2026-06-25T19:35:17.533Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-825","CWE-416"],"updated_at":"2026-11-02T14:20:06.216584Z"}],"euvd":[{"id":"EUVD-2026-26237","description":"Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption.\n\nThe Parse, print, getline, and getline_all methods invoke registered callbacks (for example after_parse, before_print, or on_error) and cache the Perl argument stack pointer across the call. If a callback extends the argument stack enough to trigger a reallocation, the return value is written through the stale pointer into the freed buffer, and the caller reads the original $self argument as the return value instead.\n\nCalling code that expects parsed data from getline_all receives the Text::CSV_XS object in its place, leading to logic errors or crashes. Text::CSV_XS objects used without any registered callbacks are not affected.","status":"published","published":"2026-04-29T14:22:29Z","modified":"2026-06-25T19:35:17Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:25.316004Z"}],"ghsa":[{"id":"GHSA-29pg-8q2m-r6xm","title":"Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend...","description":"Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption.\n\nThe Parse, print, getline, and getline_all methods invoke registered callbacks (for example after_parse, before_print, or on_error) and cache the Perl argument stack pointer across the call. If a callback extends the argument stack enough to trigger a reallocation, the return value is written through the stale pointer into the freed buffer, and the caller reads the original $self argument as the return value instead.\n\nCalling code that expects parsed data from getline_all receives the Text::CSV_XS object in its place, leading to logic errors or crashes. Text::CSV_XS objects used without any registered callbacks are not affected.","status":"published","published":"2026-04-29T15:30:40Z","modified":"2026-06-25T21:31:18Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:08:59.328511Z"}],"nvd":[{"id":"CVE-2026-7111","description":"Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption.\n\nThe Parse, print, getline, and getline_all methods invoke registered callbacks (for example after_parse, before_print, or on_error) and cache the Perl argument stack pointer across the call. If a callback extends the argument stack enough to trigger a reallocation, the return value is written through the stale pointer into the freed buffer, and the caller reads the original $self argument as the return value instead.\n\nCalling code that expects parsed data from getline_all receives the Text::CSV_XS object in its place, leading to logic errors or crashes. Text::CSV_XS objects used without any registered callbacks are not affected.","status":"published","published":"2026-04-29T15:16:09.183Z","modified":"2026-10-26T20:10:00.16Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-416","CWE-825"],"updated_at":"2026-11-02T14:12:16.626888Z"}],"osv":[{"id":"CVE-2026-7111","title":"Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption","description":"Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption.\n\nThe Parse, print, getline, and getline_all methods invoke registered callbacks (for example after_parse, before_print, or on_error) and cache the Perl argument stack pointer across the call. If a callback extends the argument stack enough to trigger a reallocation, the return value is written through the stale pointer into the freed buffer, and the caller reads the original $self argument as the return value instead.\n\nCalling code that expects parsed data from getline_all receives the Text::CSV_XS object in its place, leading to logic errors or crashes. Text::CSV_XS objects used without any registered callbacks are not affected.","status":"published","published":"2026-04-29T14:22:29.358Z","modified":"2026-10-28T02:30:21.78093848Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416","CWE-825"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"DEBIAN-CVE-2026-7111","description":"Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption.  The Parse, print, getline, and getline_all methods invoke registered callbacks (for example after_parse, before_print, or on_error) and cache the Perl argument stack pointer across the call. If a callback extends the argument stack enough to trigger a reallocation, the return value is written through the stale pointer into the freed buffer, and the caller reads the original $self argument as the return value instead.  Calling code that expects parsed data from getline_all receives the Text::CSV_XS object in its place, leading to logic errors or crashes. Text::CSV_XS objects used without any registered callbacks are not affected.","status":"published","published":"2026-04-29T15:16:09.183Z","modified":"2026-10-27T09:47:35.204391711Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"UBUNTU-CVE-2026-7111","description":"Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption. The Parse, print, getline, and getline_all methods invoke registered callbacks (for example after_parse, before_print, or on_error) and cache the Perl argument stack pointer across the call. If a callback extends the argument stack enough to trigger a reallocation, the return value is written through the stale pointer into the freed buffer, and the caller reads the original $self argument as the return value instead. Calling code that expects parsed data from getline_all receives the Text::CSV_XS object in its place, leading to logic errors or crashes. Text::CSV_XS objects used without any registered callbacks are not affected.","status":"published","published":"2026-04-29T15:16:00Z","modified":"2026-10-17T12:59:30.808749357Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:03.035847Z"},{"id":"AZL-85922","title":"CVE-2026-7111 affecting package perl-Text-CSV_XS 1.60-1","description":"Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption.\n\nThe Parse, print, getline, and getline_all methods invoke registered callbacks (for example after_parse, before_print, or on_error) and cache the Perl argument stack pointer across the call. If a callback extends the argument stack enough to trigger a reallocation, the return value is written through the stale pointer into the freed buffer, and the caller reads the original $self argument as the return value instead.\n\nCalling code that expects parsed data from getline_all receives the Text::CSV_XS object in its place, leading to logic errors or crashes. Text::CSV_XS objects used without any registered callbacks are not affected.","status":"published","published":"2026-04-29T15:16:09Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:25.190302Z"},{"id":"MGASA-2026-0370","title":"Updated perl-Text-CSV_XS packages fix a security vulnerability","description":"Text::CSV_XS versions before 1.62 for Perl have a use-after-free when\nregistered callbacks extend the Perl argument stack, which may enable\ntype confusion or memory corruption.\n","status":"published","published":"2026-09-02T16:59:28Z","modified":"2026-09-02T17:00:04.622789249Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:10774-1","title":"perl-Text-CSV_XS-1.620.0-1.1 on GA media","description":"These are all security issues fixed in the perl-Text-CSV_XS-1.620.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-13T00:00:00Z","modified":"2026-05-14T08:17:20.143142Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20708-1","title":"Security update for perl-Text-CSV_XS","description":"This update for perl-Text-CSV_XS fixes the following issue:\n\n- CVE-2026-7111: use-after-free when registered callbacks extend the Perl argument stack may enable type confusion or\n  memory corruption (bsc#1263690).\n","status":"published","published":"2026-05-07T16:15:05Z","modified":"2026-05-10T18:23:48.487022Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:1936-1","title":"Security update for perl-Text-CSV_XS","description":"This update for perl-Text-CSV_XS fixes the following issue\n\n- CVE-2026-7111: use-after-free when registered callbacks extend the Perl argument stack may enable type confusion or\n  memory corruption (bsc#1263690).\n","status":"published","published":"2026-05-18T07:41:34Z","modified":"2026-05-19T08:45:07.628409562Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:21596-1","title":"Security update for perl-Text-CSV_XS","description":"This update for perl-Text-CSV_XS fixes the following issue:\n\n- CVE-2026-7111: use-after-free when registered callbacks extend the Perl argument stack may enable type confusion or\n  memory corruption (bsc#1263690).\n","status":"published","published":"2026-05-07T16:13:34Z","modified":"2026-05-16T18:25:01.519794Z","updated_at":"2026-11-02T15:54:02.312556Z"}]}}