CVE-2026-110752 in Text::CSV_XS
Summary
by MITRE • 10/17/2026
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.
fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements.
An application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified in Text::CSV_XS versions prior to 1.65 represents a critical resource exhaustion flaw rooted in improper input validation and unbounded array allocation within Perl's CSV parsing logic. This issue specifically affects the handling of RFC 7111 selectors, which are used to define specific rows or columns for extraction from comma-separated value files. The core technical deficiency lies in how the library processes fragment requests that specify ranges using row= or col= parameters. Instead of validating these ranges against the actual dimensions of the input file before allocating memory, the parser expands the selector into a full array containing one element per selected index immediately upon receipt of the request. This design choice assumes that the specified range will always be reasonable and within the bounds of typical data files, failing to account for maliciously crafted inputs designed to exploit this assumption.
The operational impact of this flaw is severe memory exhaustion leading to application crashes. When an attacker supplies a fragment parameter with an excessively large range, such as row=1-400000000 on a file that contains only two lines, the library attempts to allocate an array with four hundred million elements. This allocation occurs before any actual data reading takes place, meaning the system reserves significant memory resources based solely on the metadata of the request rather than the content itself. Because Perl's eval mechanism cannot catch out-of-memory errors generated by such massive allocations, the process terminates abruptly without graceful error handling or cleanup. This results in a reliable denial-of-service condition where any application relying on Text::CSV_XS to parse user-supplied CSV data becomes vulnerable to remote resource exhaustion attacks.
From a classification perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, and more specifically CWE-789, the general category of memory allocation without limits or ceilings. The attack vector is consistent with ATT&CK technique T1496, Resource Hijacking, where an adversary uses computational resources to disrupt service availability. The lack of boundary checking for explicit end columns in cell= selectors further exacerbates the issue by allowing scenarios where the parser does not clamp values to the actual row length, reinforcing the potential for excessive memory usage even when partial data is present.
Mitigation strategies must focus on immediate version updates and defensive coding practices. Organizations using Text::CSV_XS should upgrade to version 1.65 or later, which implements proper clamping of selectors to the actual dimensions of the input file before allocation occurs. For applications that cannot immediately update their dependencies, implementing a pre-processing step to validate CSV structure and range parameters against known limits is essential. Developers should enforce strict maximum bounds on row and column indices accepted by the parser, ensuring that any request exceeding these thresholds is rejected prior to invoking the vulnerable parsing functions. Additionally, monitoring system memory usage during CSV processing can help detect anomalous spikes indicative of such attacks in real-time environments.