CVE-2026-110754: medium-severity vulnerability in Text-CSV_XS
Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.3%
Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline.
getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error.
A long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Text-CSV_XSRelated CVEs — Text-CSV_XS
In the same product, most dangerous first.
CVE-2026-110755HIGHText::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getlineEPSS 0.4%CVE-2026-110752HIGHText::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragmentEPSS 0.4%CVE-2026-110759CRITICALText::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parseEPSS 0.4%CVE-2026-110757CRITICALText::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combineEPSS 0.4%CVE-2026-110756CRITICALText::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in printEPSS 0.4%CVE-2026-110753CRITICALText::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getlineEPSS 0.4%