Bug 2555389

Summary:	CVE-2026-110754 perl-Text-CSV_XS: perl-Text-CSV_XS: Denial of Service via memory leak during malformed CSV parsing [epel-all]
Product:	[Fedora] Fedora EPEL	Reporter:	Ganesh <gnaik>
Component:	perl-Text-CSV_XS	Assignee:	Paul Howarth <paul>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	epel10	CC:	anon.amish, mspacek, paul, perl-devel, xavier
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["aa603b92-3421-4e1b-83f9-18b824f9d8a0"]}
Fixed In Version:	perl-Text-CSV_XS-1.65-1.el10_4	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-24 00:30:44 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2554505

Description Ganesh 2026-10-19 05:34:24 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline.

getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error.

A long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.

Comment 1 Fedora Update System 2026-10-19 07:25:55 UTC

FEDORA-EPEL-2026-1fb2093be8 (perl-Text-CSV_XS-1.65-1.el10_4) has been submitted as an update to Fedora EPEL 10.4.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-1fb2093be8

Comment 2 Fedora Update System 2026-10-19 07:27:50 UTC

FEDORA-EPEL-2026-a6a8c9862b (perl-Text-CSV_XS-1.65-1.el10_3) has been submitted as an update to Fedora EPEL 10.3.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-a6a8c9862b

Comment 3 Fedora Update System 2026-10-19 07:29:36 UTC

FEDORA-EPEL-2026-a59a080f4e (perl-Text-CSV_XS-1.65-1.el10_2) has been submitted as an update to Fedora EPEL 10.2.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-a59a080f4e

Comment 4 Fedora Update System 2026-10-19 07:31:34 UTC

FEDORA-EPEL-2026-937362387a (perl-Text-CSV_XS-1.65-1.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-937362387a

Comment 5 Fedora Update System 2026-10-19 07:33:32 UTC

FEDORA-EPEL-2026-20062595ed (perl-Text-CSV_XS-1.65-1.el8) has been submitted as an update to Fedora EPEL 8.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-20062595ed

Comment 6 Fedora Update System 2026-10-24 00:30:44 UTC

FEDORA-EPEL-2026-1fb2093be8 (perl-Text-CSV_XS-1.65-1.el10_4) has been pushed to the Fedora EPEL 10.4 stable repository.
If problem still persists, please make note of it in this bug report.