CVE-2026-110754: Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline
Text::CSVXS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline.
getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error.
A long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Text::CSV_XSto a version that resolves this vulnerability.Fixed in 1.65
Event History
Frequently Asked Questions
Who is realistically exposed to memory exhaustion from this issue?
Long-running Perl processes that use Text::CSV_XS getline to parse untrusted CSV input are exposed. Repeated malformed records can cause the process to retain parsed fields from each failed record until memory is exhausted.
What input is required to trigger the leak?
An attacker or other input source must provide CSV records with syntax errors to code that calls getline. Each failed parse causes getline to return undef while retaining the array and fields accumulated before the error.
Are successful CSV records affected?
The described leak occurs when getline encounters a record with a syntax error. On successful parsing, getline returns a reference to the newly collected fields array.
How can I tell whether an application may be affected?
Check whether it uses Text::CSV_XS before version 1.65 and calls getline on attacker-controlled or otherwise untrusted CSV data. Affected processes may show memory growth correlated with repeated CSV parse failures.