SUSE-SU-2026:5120-1: Security update for perl-Text-CSV_XS

Q: What kinds of applications are most exposed to the denial-of-service issues?

Applications that process attacker-controlled CSV input are exposed to memory exhaustion from large RFC 7111 selector ranges or malformed CSV syntax, and to CPU exhaustion when parsing CR-only lines. The affected operations named in the update are fragment() and getline().

Q: What input is needed to trigger the memory-corruption issue?

The issue is associated with strip_trail_whitespace when allow_whitespace is enabled. Under that condition, missing buffer-boundary validation can cause an out-of-bounds heap read and memory corruption.

Q: Could CSV output be manipulated rather than merely causing a denial of service?

Yes. Numeric-flagged strings containing newline characters can be written without quoting by combine() and print(), allowing record splitting and row injection. Invalid UTF-8 bytes during print() buffer flushes can also silently truncate fields.

Q: Are there data-integrity symptoms that may indicate exposure?

Potential symptoms include unexpected row or record splits in generated CSV output, silently truncated output fields, or an unexpected 0xFF byte after end-of-file handling following a lone CR. These symptoms correspond to separate fixes in combine()/print(), print(), and end-of-file processing respectively.

Published Nov 5, 2026

Updated

This update for perl-Text-CSVXS fixes the following issues:

- CVE-2026-110752: unclamped RFC 7111 selector range pre-allocation in fragment() can cause memory exhaustion via large index ranges (bsc#1286138). - CVE-2026-110754: unfreed field array memory leak on getline() syntax errors can lead to process memory exhaustion via malformed CSV input (bsc#1286188). - CVE-2026-110755: quadratic buffer copying overhead during CR-only line parsing in getline() can cause CPU exhaustion and denial of service (bsc#1286198). - CVE-2026-110756: invalid UTF-8 bytes during buffer flushes in print() can cause silent field truncation (bsc#1286130). - CVE-2026-110757: unquoted writing of numeric-flagged strings containing newlines in combine() and print() can cause record splitting and row injection (bsc#1286191). - CVE-2026-110758: missing buffer start boundary check in striptrailwhitespace under allowwhitespace can cause heap out-of-bounds read and memory corruption (bsc#1286137). - CVE-2026-110759: improper end-of-file marker handling after a lone CR can cause Text::CSVXS to inject an unexpected 0xFF byte (bsc#1286128).

Other sources

This update for perl-Text-CSVXS fixes the following issues: CVE-2026-110752: unclamped RFC 7111 selector range pre-allocation in fragment() can cause memory exhaustion via large index ranges (bsc#1286138). CVE-2026-110754: unfreed field array memory leak on getline() syntax errors can lead to process memory exhaustion via malformed CSV input (bsc#1286188). CVE-2026-110755: quadratic buffer copying overhead during CR-only line parsing in getline() can cause CPU exhaustion and denial of service (bsc#1286198). CVE-2026-110756: invalid UTF-8 bytes during buffer flushes in print() can cause silent field truncation (bsc#1286130). CVE-2026-110757: unquoted writing of numeric-flagged strings containing newlines in combine() and print() can cause record splitting and row injection (bsc#1286191). CVE-2026-110758: missing buffer start boundary check in striptrailwhitespace under allowwhitespace can cause heap out-of-bounds read and memory corruption (bsc#1286137). CVE-2026-110759: improper end-of-file marker handling after a lone CR can cause Text::CSVXS to inject an unexpected 0xFF byte (bsc#1286128).

— SUSE