{"id":"CVE-2026-110752","kind":"vulnerability","aliases":["CVE-2026-110752"],"related":[],"title":"Text::CSV_XS: RFC 7111 fragment selector exhausts memory and kills the process","description":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.\n\nfragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements.\n\nAn application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.","summary":"Versions of Text::CSV_XS before 1.65 expand a row or column selector in a fragment into one array element per index before reading any data, so a large range such as row=1-400000000 allocates hundreds of millions of elements. An attacker who controls the fragment string can exhaust memory and crash the Perl process.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","perl","text-csv-xs","web-apps"],"not_affected_if":["no-request-fragment","static-input"],"how_to_check":"- Run `perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION'` and compare against `1.65`.\n- Search application dependencies for `Text::CSV_XS` and find any call to `fragment` or `csv` that takes a request-supplied fragment.","fix":"- Upgrade Text::CSV_XS to `1.65` or later.\n- Until upgraded, do not pass user-supplied fragment strings to `fragment` or `csv`, or validate ranges before calling them.","status":"open","published_at":"2026-10-16T23:17:00+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:24:51+00:00","updated_at":"2026-10-25T03:24:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:24:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Text::CSV_XS to `1.65` or later.\n- Until upgraded, do not pass user-supplied fragment strings to `fragment` or `csv`, or validate ranges before calling them.","reach":"internet","title":"Text::CSV_XS: RFC 7111 fragment selector exhausts memory and kills the process","impact":"medium","summary":"Versions of Text::CSV_XS before 1.65 expand a row or column selector in a fragment into one array element per index before reading any data, so a large range such as row=1-400000000 allocates hundreds of millions of elements. An attacker who controls the fragment string can exhaust memory and crash the Perl process.","category":"package","nicknames":[],"who_cares":["perl","text-csv-xs","web-apps"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker crashes the Perl process by exhausting memory with one request.","analyst_note":"","how_to_check":"- Run `perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION'` and compare against `1.65`.\n- Search application dependencies for `Text::CSV_XS` and find any call to `fragment` or `csv` that takes a request-supplied fragment.","needs_analyst":false,"not_affected_if":["no-request-fragment","static-input"],"who_is_affected":"Applications that use Text::CSV_XS fragment or csv with a fragment taken from a request, query string or other untrusted input are exposed. Programs that only parse CSV files they generate or that never accept a fragment from outside can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000636,"input_tokens":3434,"output_tokens":586,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110752':16A,19A '-2026':15A,18A '-400000000':63B,159C '1':62B,158C '1.65':35B,90C '400':167C '7111':5A,105C 'alloc':64B,97C,166C 'allow':93C 'app':28B 'applic':171C 'array':47B,118C 'attack':71B 'cannot':201C 'catch':202C 'cell':141C 'check':155C 'clamp':134C 'col':114C 'column':40B,138C 'control':73B 'crash':81B 'csv':2A,24B,32B,86C,182C 'cve':14A,17A 'data':54B,129C 'element':48B,69B,121C,169C 'end':137C,190C 'entri':99C 'error':198C 'eval':200C 'exhaust':8A,78B,95C,187C 'expand':36B,110C 'explicit':136C 'file':165C 'fragment':6A,44B,75B,108C,109C,178C,180C 'hundr':65B 'index':50B,101C,124C 'kill':11A 'larg':57B 'line':164C 'made':185C 'memori':9A,79B,94C,188C,197C 'million':67B,168C 'one':46B,98C,120C 'order':150C 'packag':20B 'pass':173C 'per':49B,100C,122C 'perl':21B,83B,92C 'process':13A,84B,192C 'rang':58B,153C 'read':52B,127C 'request':176C 'request-suppli':175C 'rfc':4A,104C 'row':38B,61B,112C,145C,157C 'select':123C 'selector':7A,41B,106C,115C,142C 'string':76B 'suppli':177C 'syntax':148C 'text':1A,23B,31B,85C 'text-csv-x':22B 'two':163C 'two-lin':162C 'version':29B,88C 'web':27B 'web-app':26B 'xs':3A,25B,33B,87C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Text::CSV_XS fragment or csv with a fragment taken from a request, query string or other untrusted input are exposed. Programs that only parse CSV files they generate or that never accept a fragment from outside can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T23:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110752","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110752","severity":null,"published_at":"2026-10-16T23:17:00+00:00","modified_at":"2026-10-20T19:17:29+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}