Skip to content
Heist/ feed
Back to feed
Medium

Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline

Type: advisorySources: OSV

Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error. A long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-110754
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 17:14 UTC · Revision 1

Source evidence

Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline

core-osv · Original source

Published 16 Oct 2026, 22:06 UTC

Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error. A long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.

osv:CVE-2026-110754
Complete source record
{
  "id": "1c5e32e9802ba453c0994b57b5bc0bf6f5463f9598f85b69f9d73b7222323356",
  "url": "https://osv.dev/vulnerability/CVE-2026-110754",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline",
    "summary": "Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error. A long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.",
    "evidence": "osv:CVE-2026-110754",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-110754",
      "aliases": [
        "CVE-2026-110754"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/cpan-authors/text-csv_xs",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "84085bcda35b916ff251e433cc5b7a1cf04066f5"
                },
                {
                  "fixed": "eb4f739ffc605bfb1ab710e5330704faa0e89f08"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.65"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "eb4f739ffc605bfb1ab710e5330704faa0e89f08"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "1.64",
            "1.63",
            "1.62",
            "1.61",
            "1.60",
            "1.59",
            "1.58",
            "1.56",
            "1.55",
            "1.54",
            "1.53",
            "1.51",
            "1.50",
            "1.49",
            "1.48",
            "1.47",
            "1.46",
            "1.45",
            "1.44",
            "1.43",
            "1.42",
            "1.41",
            "1.40",
            "1.39",
            "1.38",
            "1.37",
            "1.36",
            "1.35",
            "1.34",
            "1.33",
            "1.32",
            "1.31",
            "1.30",
            "1.29",
            "1.28",
            "1.27",
            "1.26",
            "1.25",
            "1.24",
            "1.23",
            "1.22",
            "1.21",
            "1.20",
            "1.19",
            "1.18",
            "1.17",
            "1.16",
            "1.15",
            "1.14",
            "1.13",
            "1.12",
            "1.11",
            "1.10",
            "1.09",
            "1.08",
            "1.07",
            "1.06",
            "1.05",
            "1.04",
            "1.03",
            "1.02",
            "1.01",
            "1.00",
            "0.99",
            "0.98",
            "0.97",
            "0.96",
            "0.95",
            "0.94",
            "0.93",
            "0.92",
            "0.91",
            "0.90",
            "0.88",
            "0.87",
            "0.86",
            "0.85",
            "0.84",
            "0.83",
            "0.82",
            "0.81",
            "0.80",
            "0.79",
            "0.78",
            "0.77",
            "0.76",
            "0.75",
            "0.74",
            "0.73",
            "0.72",
            "0.71",
            "0.70",
            "0.69",
            "0.68",
            "0.67",
            "0.66",
            "0.65",
            "0.64",
            "0.63",
            "0.62",
            "0.61",
            "0.60",
            "0.59",
            "0.58",
            "0.57",
            "0.56",
            "0.55",
            "0.54",
            "0.53",
            "0.52",
            "0.51",
            "0.50",
            "0.46",
            "0.45",
            "0.44",
            "0.43",
            "0.42",
            "0.41",
            "0.40",
            "0.37",
            "0.36",
            "0.35-Valloire",
            "0.34",
            "0.33"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110754.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:30.602892446Z",
      "provider": "osv",
      "references": [
        "https://cpan.org/modules",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110754.json",
        "https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-110754",
        "https://github.com/cpan-authors/Text-CSV_XS/commit/eb4f739ffc605bfb1ab710e5330704faa0e89f08.patch",
        "https://github.com/cpan-authors/Text-CSV_XS"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-401"
        ],
        "cna_assigner": "CPANSec",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110754.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-110754",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 497750,
  "published_at": "2026-10-16T22:06:46.839+00:00"
}