CVE-2026-110752

Executive Summary

CVE-2026-110752 is a memory exhaustion vulnerability in the Perl module Text::CSV_XS versions before 1.65. When an application passes a request-supplied RFC 7111 fragment (a row=, col=, or cell= selector) into the fragment or csv functions, the module pre-allocates one array element per selected index before reading any data and does not clamp an explicit end column to the actual row length. An attacker can supply an oversized range such as row=1-400000000 against a two-line file, causing hundreds of millions of allocations and terminating the process with an un-catchable Out of memory error.

Applications that expose CSV fragment selection to untrusted input are affected. Because the failure is a fatal allocator error rather than a catchable exception, eval-based error handling cannot contain it, and the affected service dies rather than returning an error. No CVSS score, EPSS estimate, public PoC, or CISA KEV entry is currently available.

Technical Analysis

Text::CSV_XS is a widely deployed Perl library for parsing and generating CSV data. RFC 7111 defines a URI fragment syntax for referencing subsets of tabular data, including row= and col= selectors and a cell= selector. The vulnerable code path expands these selectors into in-memory arrays before parsing input: it builds a structure sized to the highest index referenced in the selector, not to the actual number of rows or columns present in the target file.

Two weaknesses combine to create the issue:

1. Unbounded pre-allocation. The selector is expanded into an array with one element per selected index before any data is read. The library validates only the syntax and ordering of the ranges, not their magnitude relative to the underlying dataset. A range like row=1-400000000 passes validation even against a two-line file.
2. Missing clamping in cell= selectors. For a cell= selector, an explicit end column is not clamped to the length of the target row, allowing column ranges beyond the row's actual width to drive the same oversized allocation.

The result conforms to CWE-770 (Allocation of Resources Without Limits or Throttling). The allocation is memory-only, so the failure mode is the Perl process aborting with an Out of memory error. Critically, this condition occurs at the allocation layer and is therefore not trappable via eval — applications cannot gracefully recover, and the connection or worker is lost entirely.

The attack surface is any application that maps untrusted request parameters (query strings, path segments, or fragment-like parameters) into Text::CSV_XS fragment/selector arguments. This is common in data-access APIs, reporting endpoints, and CSV-to-JSON/HTTP gateways built in Perl. The vulnerability is entirely pre-authentication if the parsing endpoint is reachable; no credentials or malformed CSV content are needed — only the oversized selector string.

Exploitation Scenarios

No public PoC is available; the following chain is inferred from the vulnerability class (unbounded resource allocation) and the concrete selector syntax documented in the NVD description.

1. Reconnaissance / target identification. The attacker identifies an application endpoint that accepts an RFC 7111 fragment or selector-style parameter and returns CSV-derived data (for example, a paginated report or tabular export API). Error messages, API documentation, or numeric range parameters (row=, col=, cell=) reveal that the backend honours selector syntax. The target need not be large; a two-line CSV suffices.

2. Triggering the flaw class. The attacker submits a request whose selector references a range far beyond the data size, e.g. row=1-400000000. The library validates syntax and ordering only and expands the selector into an array with one element per index — roughly 400 million entries in the reference example — before reading file data. For cell= selectors, an explicit end column beyond the row width is likewise not clamped and produces the same oversized allocation.

3. Execution method. This is a request-driven, code-path-level trigger: a single crafted HTTP request (or a small burst) through the vulnerable fragment or csv entry point. There is no payload file, shellcode, or memory-corruption primitive — the "payload" is the numeric range in the selector itself.

4. Post-exploitation impact. The Perl process exhausts memory and is killed by the allocator with an Out of memory error that eval cannot catch. The service terminates (crash-to-restart), producing repeated unavailability under sustained requests. There is no confidentiality or integrity impact: the flaw is purely availability-focused. Repeated parallel requests amplify the effect into a sustained denial of service against the endpoint and any co-located workloads on the same host.

Impact Assessment

• Confidentiality: None. No data read or exfiltration path is described.
• Integrity: None described.
• Availability: Low to moderate, depending on request concurrency and worker model. A single request kills one process; parallelized attacks against a multi-worker service can render the endpoint persistently unavailable.
• Scope: Unchanged — the impact is confined to the vulnerable application process, though host-level memory pressure can affect co-resident services.

Blast radius. Any Perl application embedding Text::CSV_XS < 1.65 that exposes fragment or selector handling to external input. Internal batch jobs are not affected unless they process untrusted selectors. Multi-tenant APIs and shared integration platforms are the highest-risk deployment pattern because one tenant's oversized selector terminates a shared worker.

Business impact centres on service disruption of data-export/reporting endpoints and loss of in-flight work when workers crash. The un-catchable nature of the failure complicates graceful degradation and increases mean time to recovery.

Detection Guidance

Sigma Rule

title: RFC 7111 Selector with Oversized Row/Col Range (Text::CSV_XS CVE-2026-110752)
id: 2b7c9e3a-csv-xs-110752
status: experimental
description: Detects request parameters containing RFC 7111 row/col/cell selectors with abnormally large end indices indicative of memory-exhaustion attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110752
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_params:
    c-uri|contains:
      - 'row='
      - 'col='
      - 'cell='
  selection_large:
    c-uri|re: '(row|col)(=[0-9]+-[0-9]{7,})|(cell=[0-9]+-[0-9]+-[0-9]+-[0-9]{7,})'
  condition: selection_params and selection_large
fields:
  - c-ip
  - c-uri
  - cs-method
falsepositives:
  - Legitimate bulk-range exports against genuinely large datasets (baseline expected sizes first)
level: medium

YARA Rule

rule Text_CSV_XS_Selector_Abuse_CVE_2026_110752
{
    meta:
        description = "Detects oversized RFC 7111 selectors in captured HTTP payloads or application logs"
        cve = "CVE-2026-110752"
        author = "valtersit.com"
    strings:
        $row = /row=[0-9]+-[0-9]{7,}/
        $col = /col=[0-9]+-[0-9]{7,}/
        $cell = /cell=[0-9]+-[0-9]+-[0-9]+-[0-9]{7,}/
    condition:
        filesize < 10KB and any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110752 Text::CSV_XS oversized RFC 7111 selector attempt"; flow:to_server,established; pcre:"/(?:row|col)=[0-9]+-[0-9]{7,}/Ui"; pcre:"/cell=[0-9]+-[0-9]+-[0-9]+-[0-9]{7,}/Ui"; classtype:attempted-dos; sid:11075201; rev:1; reference:cve,2026-110752;)

(Operators should tune the {7,} digit threshold to their environment's largest legitimate index size to reduce noise; existing PCRE anchors are provided as two alternative selectors.)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method == "GET" and
   regex(http.request.uri, ".*(row|col)=[0-9]+-[0-9]{7,}.*")]
  [network where http.response.status_code == 500 or http.response.status_code == 502]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
| eval uri=coalesce(uri, request_uri)
| regex uri="(row|col)=[0-9]+-[0-9]{7,}|cell=[0-9]+-[0-9]+-[0-9]+-[0-9]{7,}"
| stats count values(uri) as sample_uris by src_ip status
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,cve-2026-110752,">
  <rule id="110752" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>row=</match>
    <regex type="pcre2">(?:row|col)=[0-9]+-[0-9]{7,}|cell=[0-9]+-[0-9]+-[0-9]+-[0-9]{7,}</regex>
    <description>CVE-2026-110752: oversized RFC 7111 selector may cause memory exhaustion in Text::CSV_XS</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>denial_of_service,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states versions before 1.65 are affected, implying 1.65 as the fixed release; this should be verified against CPAN before relying on it.

1) Immediate mitigations.

• Validate and bound all selector inputs at the application layer: reject any row=, col=, or cell= end index exceeding a sane cap (e.g., the dataset's actual row/column count), and refuse ranges whose length exceeds a deployment-defined maximum.
• Do not pass raw request-supplied fragments into the fragment or csv functions; parse the fragment yourself and construct the selector programmatically from validated integers.
• Apply ingress rate limiting and request-size limits on endpoints that accept selectors; since the failure is not catchable via eval, kill/recycle workers proactively rather than relying on error handling.
• Run Perl application workers under a memory rlimit (e.g., ulimit -v) so exhaustion kills only the worker, not the host; front with a supervisor that restarts cleanly.

2) Patch / upgrade steps.

• Upgrade Text::CSV_XS to 1.65 or later via CPAN and confirm the installed version with perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION'.
• Rebuild container images and dependency locks, then redeploy to ensure all workers run the patched library. Verify no vendored/embedded copies remain at < 1.65.

3) Long-term hardening.

• Treat all parsing library versions as part of the attack surface; include Perl/CPAN dependencies in SCA and SCA-driven upgrade cadence.
• Adopt allow-list validation for all numeric indexing and pagination parameters across APIs.
• Deploy the provided detection rules and baseline legitimate selector sizes to tune thresholds.
• Enforce per-process resource limits and workload isolation so any single unhandled resource-exhaustion path cannot take down the host.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110752
• CWE-770 Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
• RFC 7111 (URI Fragment Identifiers for the text/csv Media Type): https://www.rfc-editor.org/rfc/rfc7111
• CPAN Text::CSV_XS distribution: https://metacpan.org/pod/Text::CSV_XS
• MITRE ATT&CK T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/

No CVSS score, EPSS estimate, public PoC, exploit-in-the-wild evidence, or CISA KEV listing is currently associated with this CVE.