Important: perl-Text-CSV_XS

Issue Overview: Text::CSVXS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns und...

MGASA-2026-0563 Updated perl-Text-CSV_XS package fixes security vulnerabilities

Text::CSVXS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. CVE-2026-110752 Text::CSVXS versions from 1.46 before 1.65 for Perl have a use-after-free of bindcolumns variables when skipemptyrows skips an empty line in...

Updated perl-Text-CSV_XS package fixes security vulnerabilities

Text::CSVXS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. CVE-2026-110752 Text::CSVXS versions from 1.46 before 1.65 for Perl have a use-after-free of bindcolumns variables when skipemptyrows skips an empty line in...

Fedora 43 : perl-Text-CSV_XS (2026-39d5c46c12)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-39d5c46c12 advisory. Current upstream release, with several security fixes. Tenable has extracted the preceding description block directly from the Fedora security...

Fedora 44 : perl-Text-CSV_XS (2026-035fae971f)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-035fae971f advisory. Current upstream release, with several security fixes. Tenable has extracted the preceding description block directly from the Fedora security...

UBUNTU-CVE-2026-110753

Text::CSVXS versions from 1.46 before 1.65 for Perl have a use-after-...

UBUNTU-CVE-2026-110758

Text::CSVXS versions before 1.65 for Perl read before the start of an...

UBUNTU-CVE-2026-110759

Text::CSVXS versions before 1.65 for Perl return a 0xFF byte that is...

UBUNTU-CVE-2026-110752

Text::CSVXS versions before 1.65 for Perl allow memory exhaustion by...

OPENSUSE-SU-2026:12218-1 perl-Text-CSV_XS-1.650.0-1.1 on GA media

These are all security issues fixed in the perl-Text-CSVXS-1.650.0-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-110752

Text::CSVXS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end colum...

SUSE CVE-2026-110753

Text::CSVXS versions from 1.46 before 1.65 for Perl have a use-after-free of bindcolumns variables when skipemptyrows skips an empty line in getline. With bindcolumns, the parser writes each field into the caller's own scalar without taking a reference to it. When skipemptyrows skips an empty las...

SUSE CVE-2026-110754

Text::CSVXS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never fre...

SUSE CVE-2026-110755

Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the...

SUSE CVE-2026-110756

Text::CSVXS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character...

SUSE CVE-2026-110757

Text::CSVXS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric...

SUSE CVE-2026-110758

Text::CSVXS versions before 1.65 for Perl read before the start of an all-blank field under allowwhitespace in striptrailwhitespace. Under allowwhitespace, striptrailwhitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of onl...

SUSE CVE-2026-110759

Text::CSVXS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker i...

EUVD-2026-103198

Text::CSVXS versions before 1.65 for Perl read before the start of an all-blank field under allowwhitespace in striptrailwhitespace. Under allowwhitespace, striptrailwhitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of onl...

EUVD-2026-103193

Text::CSVXS versions from 1.46 before 1.65 for Perl have a use-after-free of bindcolumns variables when skipemptyrows skips an empty line in getline. With bindcolumns, the parser writes each field into the caller's own scalar without taking a reference to it. When skipemptyrows skips an empty las...