Live › vulnerability › CVE-2026-110752
Go to dashboardVersions of Text::CSV_XS before 1.65 expand a row or column selector in a fragment into one array element per index before reading any data, so a large range such as row=1-400000000 allocates hundreds of millions of elements. An attacker who controls the fragment string can exhaust memory and crash the Perl process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use Text::CSV_XS fragment or csv with a fragment taken from a request, query string or other untrusted input are exposed. Programs that only parse CSV files they generate or that never accept a fragment from outside can skip it.
No product ranges from the sources yet.
perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION' and compare against 1.65.Text::CSV_XS and find any call to fragment or csv that takes a request-supplied fragment.1.65 or later.fragment or csv, or validate ranges before calling them.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.
fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements.
An application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.
This page as .md · .json · in your agent: get_signal("CVE-2026-110752")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.