Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110754— Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline

Quick assessment

Affected
CVE-2026-110754
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 Text::CSV_XS 模块在 1.65 版本之前存在内存泄漏漏洞：当 方法解析记录失败时，已解析的字段会被泄露。 正常情况下， 会将记录中的字段收集到一个新数组中，仅在解析成功时返回该数组的引用。若记录存在语法错误， 会返回 ，且不会释放此前已解析的数组及字段。 因此，长期运行并解析不可信 CSV 数据的进程会保留所有接收到的畸形记录，导致重复的畸形输入最终耗尽系统内存。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.19% · P8

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 1.65 affected

I. Basic Information for CVE-2026-110754

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline
Source: CVE Program / CVE List V5
Vulnerability Description
Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error. A long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在移除最后引用时对内存的释放不恰当(内存泄露)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 1.65 -

II. Public POCs for CVE-2026-110754

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110754

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110754 (1)

Other References for CVE-2026-110754 (1)

IV. Related Vulnerabilities

Same weakness: CWE-401

V. Comments for CVE-2026-110754

No comments yet

Leave a comment