CVE-2026-110752
Description
A flaw was found in perl-Text-CSV_XS. When parsing fragment selectors, the component pre-allocates array entries for every index in a requested range before reading data and without validating the range bounds against the input. An attacker could exploit this vulnerability by providing a crafted selector with an excessively large range, leading to uncontrolled memory consumption and causing a Denial of Service (DoS).
Statement
Red Hat Product Security rates this vulnerability as an Important severity impact because unauthenticated remote attackers can trigger an immediate denial of service by causing fatal memory exhaustion in applications processing untrusted CSV queries. In Red Hat Enterprise Linux environments, perl-Text-CSV_XS is provided as a shared library module, restricting exposure to custom or third-party Perl services that accept and pass arbitrary RFC 7111 fragment selectors to the parser. Because the memory allocation failure terminates the running Perl interpreter directly instead of raising a catchable exception, affected services crash completely without the ability to recover.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to validate and restrict numeric upper bounds on row and column fragment selectors prior to invoking Text::CSV_XS fragment or csv routines: upgrade to Text::CSV_XS 1.65+ (or the fixed Perl Text Csv Xs builds), which stores range selectors as coordinate pairs and verifies index membership iteratively instead of preallocating arrays, while clamping cell column boundaries to parsed row lengths, closing all 3 injection vectors (crafted RFC 7111 row selector with large numeric range, crafted RFC 7111 col selector with large numeric range, crafted RFC 7111 cell selector with unclamped column bounds). Until patched, this is a concern on applications and services passing untrusted RFC 7111 fragment selectors to Text::CSV_XS, so strictly restrict or filter user-supplied fragment selectors to reject abnormally large range indices before passing them to fragment or csv parsing calls. As a compensating measure, restrict per-process virtual memory address space using ulimit or prlimit to contain allocation sizes, configure systemd service monitoring with WatchdogSec and automatic Restart to quickly recover from out-of-memory process terminations, and enforce cgroups v2 memory limits to isolate memory consumption and protect host-wide availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying uncontrolled memory allocation defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
