{"id":"CVE-2026-110754","kind":"vulnerability","aliases":["CVE-2026-110754"],"related":[],"title":"Text::CSV_XS: malformed CSV records leak memory in getline","description":"Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline.\n\ngetline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error.\n\nA long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.","summary":"Text::CSV_XS before 1.65 for Perl keeps the parsed fields of any CSV record that fails to parse in getline, because the array is never freed. A long-running process that parses untrusted CSV can be driven to exhaust its memory with repeated malformed input.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","perl","self-hosted","text-csv-xs"],"not_affected_if":["short-lived-scripts","trusted-input-only","version-1.65-or-later"],"how_to_check":"- Check the installed version with `perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION'` and see whether it is below `1.65`.\n- Search dependency manifests and lockfiles for `Text::CSV_XS` to find every project that pulls it in.","fix":"- Upgrade Text::CSV_XS to `1.65` or later.","status":"open","published_at":"2026-10-16T23:17:00+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:57:41+00:00","updated_at":"2026-10-25T03:57:41+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:57:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Text::CSV_XS to `1.65` or later.","reach":"unknown","title":"Text::CSV_XS: malformed CSV records leak memory in getline","impact":"medium","summary":"Text::CSV_XS before 1.65 for Perl keeps the parsed fields of any CSV record that fails to parse in getline, because the array is never freed. A long-running process that parses untrusted CSV can be driven to exhaust its memory with repeated malformed input.","category":"package","nicknames":[],"who_cares":["perl","text-csv-xs","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Repeated malformed input exhausts process memory, causing denial of service.","analyst_note":"","how_to_check":"- Check the installed version with `perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION'` and see whether it is below `1.65`.\n- Search dependency manifests and lockfiles for `Text::CSV_XS` to find every project that pulls it in.","needs_analyst":false,"not_affected_if":["version-1.65-or-later","short-lived-scripts","trusted-input-only"],"who_is_affected":"Only processes that call getline on untrusted CSV input and run long enough for leaked memory to matter, such as a daemon or web service that parses uploads. Short-lived scripts and batch jobs that parse trusted files are unlikely to be affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000606,"input_tokens":3373,"output_tokens":537,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110754':13A,16A '-2026':12A,15A '1.65':30B,78C 'array':49B,104C,130C 'collect':95C 'csv':2A,5A,24B,27B,39B,61B,74C,145C 'cve':11A,14A 'driven':64B 'error':122C,137C 'everi':147C 'exhaust':66B,157C 'fail':42B,89C 'field':36B,84C,97C,133C 'free':128C 'freed':52B 'getlin':10A,46B,93C,94C,123C 'host':21B 'input':72B,156C 'keep':33B 'leak':7A,81C 'long':55B,140C 'long-run':54B,139C 'malform':4A,71B,148C,155C 'memori':8A,68B,159C 'never':51B,127C 'new':103C 'packag':17B 'pars':35B,44B,59B,83C,91C,114C,134C,143C 'perl':18B,32B,80C 'process':57B,142C 'record':6A,40B,87C,100C,118C,149C 'refer':108C 'repeat':70B,154C 'retain':146C 'return':106C,124C 'run':56B,141C 'self':20B 'self-host':19B 'sent':152C 'succeed':115C 'syntax':121C 'text':1A,23B,26B,73C 'text-csv-x':22B 'undef':125C 'untrust':60B,144C 'version':76C 'xs':3A,25B,28B,75C","nicknames":[],"mitigations":[],"who_affected":"Only processes that call getline on untrusted CSV input and run long enough for leaked memory to matter, such as a daemon or web service that parses uploads. Short-lived scripts and batch jobs that parse trusted files are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T23:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110754","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110754","severity":null,"published_at":"2026-10-16T23:17:00+00:00","modified_at":"2026-10-20T19:17:29+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}