AZL-109748

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109748.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-109748
Upstream
Published
2026-10-16T23:17:00Z
Modified
2026-10-22T05:37:13Z
Summary
CVE-2026-110753 affecting package perl-Text-CSV_XS 1.60-1
Details

Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.

With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line.

The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.

References

Affected packages

Azure Linux:3 / perl-Text-CSV_XS

Package

Name
perl-Text-CSV_XS
Purl
pkg:rpm/azure-linux/perl-Text-CSV_XS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
1.60-1

Database specific

source
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109748.json"