========================================================================
CVE-2026-110754                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110754

  Distribution:  Text-CSV_XS
      Versions:  before 1.65
      MetaCPAN:  https://metacpan.org/dist/Text-CSV_XS
      VCS Repo:  https://github.com/cpan-authors/Text-CSV_XS

Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a
record that fails to parse in getline

Description
-----------
Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a
record that fails to parse in getline.

getline collects the fields of a record into a new array and returns a
reference to it only when the parse succeeds. When the record has a
syntax error, getline returns undef and never frees the array or the
fields parsed before the error.

A long-running process parsing untrusted CSV retains every malformed
record it is sent, so repeated malformed input exhausts its memory.

Problem types
-------------
- CWE-401 Missing Release of Memory after Effective Lifetime

Solutions
---------
Upgrade to Text-CSV_XS 1.65 or later.

References
----------
https://github.com/cpan-authors/Text-CSV_XS/commit/eb4f739ffc605bfb1ab710e5330704faa0e89f08.patch
https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes

Timeline
--------
- 2026-10-14: Fix committed to upstream repository.
- 2026-10-15: Version 1.65 released with fix.