Bug 2554505 (CVE-2026-110754)

Summary: CVE-2026-110754 perl-Text-CSV_XS: perl-Text-CSV_XS: Denial of Service via memory leak during malformed CSV parsing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Text::CSV_XS. When parsing a CSV record containing a syntax error, the getline function fails to release memory allocated for fields parsed prior to the failure. An attacker who can supply malformed CSV input to a long-running application can exploit this vulnerability to trigger repeated memory leaks, ultimately leading to memory exhaustion and a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2555382, 2555389    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-16 22:22:06 UTC 
Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline.

getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error.

A long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.