Live › vulnerability › CVE-2026-110754
Go to dashboardText::CSV_XS before 1.65 for Perl keeps the parsed fields of any CSV record that fails to parse in getline, because the array is never freed. A long-running process that parses untrusted CSV can be driven to exhaust its memory with repeated malformed input.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only processes that call getline on untrusted CSV input and run long enough for leaked memory to matter, such as a daemon or web service that parses uploads. Short-lived scripts and batch jobs that parse trusted files are unlikely to be affected.
No product ranges from the sources yet.
perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION' and see whether it is below 1.65.Text::CSV_XS to find every project that pulls it in.1.65 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline.
getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error.
A long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-110754")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.