DEBIAN-CVE-2026-110753

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-110753
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110753.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-110753
Upstream
  • CVE-2026-110753
Published
2026-10-17T07:47:31Z
Modified
2026-10-17T08:00:06Z
Summary
[none]
Details

Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line. The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.

References

Affected packages

Debian:12 / libtext-csv-xs-perl

Package

Name
libtext-csv-xs-perl
Purl
pkg:deb/debian/libtext-csv-xs-perl?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.49-1
1.49-1+deb12u1
1.50-1
1.51-1
1.52-1
1.53-1
1.54-1
1.55-1
1.56-1
1.57-1
1.59-1
1.60-1
1.61-1
1.62-1
1.64-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110753.json"

Debian:13 / libtext-csv-xs-perl

Package

Name
libtext-csv-xs-perl
Purl
pkg:deb/debian/libtext-csv-xs-perl?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.60-1
1.60-1+deb13u1
1.61-1
1.62-1
1.64-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110753.json"

Debian:14 / libtext-csv-xs-perl

Package

Name
libtext-csv-xs-perl
Purl
pkg:deb/debian/libtext-csv-xs-perl?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.60-1
1.61-1
1.62-1
1.64-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110753.json"