CVE-2026-110752: Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment
Text::CSVXS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.
fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements.
An application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Text::CSV_XSto a version that resolves this vulnerability.Fixed in 1.65
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications are exposed if they pass request-supplied RFC 7111 fragments to Text::CSV_XS fragment or csv. A small CSV file does not prevent exploitation because selector ranges are expanded before data is read.
What does an attacker need to trigger memory exhaustion?
An attacker needs control over a fragment selector accepted by the application. A syntactically valid large range such as row=1-400000000 can cause allocation of hundreds of millions of entries even for a two-line file.
Can an application recover from an attempted attack with eval?
No. The resulting Out of memory error ends the process and cannot be caught with eval.
How can I tell whether my deployment is affected?
Check the installed Text::CSV_XS version and whether the application supplies untrusted fragments to fragment or csv. Versions before 1.65 are affected.
What can be done if upgrading is not immediately possible?
Do not pass untrusted fragments to fragment or csv. Validate and enforce strict upper bounds on requested row, column, and cell selector ranges before calling the library.