CVE-2026-110754

Received Received - Intake

Memory Leak in Text::CSV_XS Perl Module

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: CPANSec

Description

Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error. A long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-110754

EUVD

EUVD-2026-103194

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

Text::CSV_XS versions before 1.65 for Perl have a memory leak issue in the getline function. When parsing CSV records with syntax errors, the function returns undef but fails to free the partially parsed array and fields, causing memory retention for each malformed record.

Detection Guidance

This vulnerability can be detected by monitoring memory usage in long-running Perl processes that use Text::CSV_XS versions before 1.65. Check for unexplained memory growth when processing CSV files. Use system monitoring tools like top, htop, or ps to observe memory consumption over time.

Impact Analysis

A long-running process using this Perl module could experience memory exhaustion if it processes many malformed CSV records. This may lead to crashes, degraded performance, or denial of service due to high memory usage.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it relates to memory exhaustion in a Perl CSV parsing library rather than data privacy or security controls.

Mitigation Strategies

Immediately upgrade Text::CSV_XS to version 1.65 or later. Review and update any Perl scripts using this module to handle malformed CSV input gracefully. Implement input validation for CSV files before processing.

Hi! I’m here to help you understand CVE-2026-110754. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70