CVE-2026-110754

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110754
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110754.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110754
Downstream
Related
Published
2026-10-16T22:06:46Z
Modified
2026-10-22T17:27:11Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline
Details

Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline.

getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error.

A long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.

Database specific 
{
    "cna_assigner":  "CPANSec",
    "cwe_ids":  [
        "CWE-401"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110754.json"
}
References

Affected packages

Git / github.com/cpan-authors/text-csv_xs

Affected ranges

Type
GIT
Repo
https://github.com/cpan-authors/text-csv_xs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
84085bcda35b916ff251e433cc5b7a1cf04066f5
Fixed
eb4f739ffc605bfb1ab710e5330704faa0e89f08
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.65"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "eb4f739ffc605bfb1ab710e5330704faa0e89f08"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*
0.33
0.34
0.35-Valloire
0.36
0.37
0.40
0.41
0.42
0.43
0.44
0.45
0.46
0.50
0.51
0.52
0.53
0.54
0.55
0.56
0.57
0.58
0.59
0.60
0.61
0.62
0.63
0.64
0.65
0.66
0.67
0.68
0.69
0.70
0.71
0.72
0.73
0.74
0.75
0.76
0.77
0.78
0.79
0.80
0.81
0.82
0.83
0.84
0.85
0.86
0.87
0.88
0.90
0.91
0.92
0.93
0.94
0.95
0.96
0.97
0.98
0.99
1.*
1.00
1.01
1.02
1.03
1.04
1.05
1.06
1.07
1.08
1.09
1.10
1.11
1.12
1.13
1.14
1.15
1.16
1.17
1.18
1.19
1.20
1.21
1.22
1.23
1.24
1.25
1.26
1.27
1.28
1.29
1.30
1.31
1.32
1.33
1.34
1.35
1.36
1.37
1.38
1.39
1.40
1.41
1.42
1.43
1.44
1.45
1.46
1.47
1.48
1.49
1.50
1.51
1.53
1.54
1.55
1.56
1.58
1.59
1.60
1.61
1.62
1.63
1.64

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110754.json"