CVE-2026-110752

A flaw was found in perl-Text-CSV_XS. When parsing fragment selectors, the component pre-allocates array entries for every index in a requested range before reading data and without validating the range bounds against the input. An attacker could exploit this vulnerability by providing a crafted selector with an excessively large range, leading to uncontrolled memory consumption and causing a Denial of Service (DoS).

Red Hat Product Security rates this vulnerability as an Important severity impact because unauthenticated remote attackers can trigger an immediate denial of service by causing fatal memory exhaustion in applications processing untrusted CSV queries. In Red Hat Enterprise Linux environments, perl-Text-CSV_XS is provided as a shared library module, restricting exposure to custom or third-party Perl services that accept and pass arbitrary RFC 7111 fragment selectors to the parser. Because the memory allocation failure terminates the running Perl interpreter directly instead of raising a catchable exception, affected services crash completely without the ability to recover.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

--- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to validate and restrict numeric upper bounds on row and column fragment selectors prior to invoking Text::CSV_XS fragment or csv routines: upgrade to Text::CSV_XS 1.65+ (or the fixed Perl Text Csv Xs builds), which stores range selectors as coordinate pairs and verifies index membership iteratively instead of preallocating arrays, while clamping cell column boundaries to parsed row lengths, closing all 3 injection vectors (crafted RFC 7111 row selector with large numeric range, crafted RFC 7111 col selector with large numeric range, crafted RFC 7111 cell selector with unclamped column bounds). Until patched, this is a concern on applications and services passing untrusted RFC 7111 fragment selectors to Text::CSV_XS, so strictly restrict or filter user-supplied fragment selectors to reject abnormally large range indices before passing them to fragment or csv parsing calls. As a compensating measure, restrict per-process virtual memory address space using ulimit or prlimit to contain allocation sizes, configure systemd service monitoring with WatchdogSec and automatic Restart to quickly recover from out-of-memory process terminations, and enforce cgroups v2 memory limits to isolate memory consumption and protect host-wide availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying uncontrolled memory allocation defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)