Memory Leak in Perl Library Affects Text::CSV_XS by HMBRAND
CVE-2026-110754

Currently unrated

Key Information:

Status
Vendor
CVE Published:
16 October 2026

What is CVE-2026-110754?

The Text::CSV_XS library for Perl, specifically versions prior to 1.65, is susceptible to a memory leak when handling malformed CSV records. When the getline function encounters syntax errors during parsing, it fails to free previously allocated memory for these records. This issue can cause long-running processes to accumulate memory usage over time, leading to potential exhaustion of system resources if multiple erroneous CSV inputs are provided. To mitigate this vulnerability, users are encouraged to upgrade to versions that address the memory management during parsing.

References

https://github.com/cpan-authors/Text-CSV_XS/commit/eb4f73...
patch
https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/cha...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.