CVE-2026-110754

Executive Summary

CVE-2026-110754 is a memory-leak vulnerability (CWE-401: Missing Release of Memory after Effective Lifetime) in Text::CSV_XS versions before 1.65 for the Perl programming language. When the getline method parses a record containing a syntax error, it returns undef but fails to free the array and previously parsed field data, causing a long-running process that continuously parses untrusted CSV input to accumulate every malformed record and eventually exhaust available memory. Any Perl application, daemon, or service that uses Text::CSV_XS to ingest attacker-supplied CSV data is at risk of a denial-of-service condition.

Technical Analysis

Text::CSV_XS is a widely used high-performance Perl module for parsing and generating Comma-Separated Values data. The method central to this vulnerability, getline, reads a single record from the input stream and returns a reference to an array of the parsed field values only when parsing completes successfully. Internally, during the parse of each record, the module accumulates fields into a newly allocated array structure prior to determining whether the record is syntactically valid.

Per the NVD description, the vulnerability arises from the error-handling path. When the record being parsed contains a syntax error, getline correctly returns undef to signal failure — but the array it created to collect the fields, together with any fields already parsed before the error was encountered, is never released. This is a classic memory leak in the exceptional path of a parser: the success path frees the transient data structure, but the failure path omits that cleanup.

The attack surface is any application that parses untrusted CSV input with a vulnerable version of Text::CSV_XS over a long-running process lifetime. Because the leaked memory is proportional to the number of malformed records processed and the size of each partially parsed record, an adversarial input stream consisting of repeated syntactically invalid records causes unbounded, monotonic memory growth. Once process memory is exhausted, behavior ranges from garbage collection pressure and latency degradation to outright out-of-memory termination, depending on the operating environment and Perl runtime limits.

The weakness mapping is CWE-401 (Missing Release of Memory after Effective Lifetime), which is a failure of resource lifecycle management rather than a memory-safety corruption class. There is no evidence in the available data of buffer overflow, use-after-free, or code-execution primitives. The impact is confined to availability through resource exhaustion. Because parse errors are typically the exact condition triggered by malicious or malformed input — as opposed to benign, well-formed data — the leak is readily reachable by remote input without authentication or user interaction.

No official CVSS score has been assigned in the supplied data, and EPSS has not yet scored this CVE. The threat profile is therefore one of a resource-exhaustion denial-of-service against long-running Perl CSV consumers.

Exploitation Scenarios

No public proof-of-concept exists for CVE-2026-110754 as of the data provided; the attack chain below is described at the vulnerability-class level and inferred from the memory-leak mechanism stated in the NVD description.

1. Reconnaissance / target identification. An adversary identifies a network-facing or data-ingesting Perl service that accepts CSV input — for example, bulk import endpoints, scheduled feed processors, reporting daemons, or message-queue consumers that use Text::CSV_XS. Fingerprinting a Perl-backed application may be inferred from response headers or behavior, but the core requirement is simply locating a long-running process that parses attacker-influenced CSV.

2. Trigger of the specific flaw class. The adversary supplies a record containing a deliberate CSV syntax error. Under the description, such a malformed record causes getline to return undef and enter the leak path, where the partially collected field array is retained rather than freed. A single malformed record produces a small leak; the attack is the repetition of this condition.

3. Payload / execution method. Because the leak is driven by repeated parse failures, the attacker does not need to exploit a memory-corruption primitive — the "payload" is simply a sustained stream of syntactically invalid CSV records. The exact malformation (e.g., an unbalanced quote or delimiter error, consistent with the reported "syntax error" condition) depends on the application's CSV dialect configuration, which the description does not further specify. The mechanism at the class level is repeated triggering of the error-handling path with records large enough to retain meaningful per-record memory.

4. Post-exploitation impact. Over time, the accumulating leaked allocations raise resident memory until the process is terminated by the operating system's out-of-memory killer, exceeds a configured memory ceiling, or degrades to the point of unavailable service. The result is denial of service to legitimate consumers of that process. There is no evidence of data theft, privilege escalation, or persistence from the vulnerability itself.

Impact Assessment

The impact is primarily to availability (CVSS availability component: High), with confidentiality and integrity unaffected. Affected systems are long-running Perl processes that parse untrusted CSV data — batch/stream importers, API back ends, ETL workers, and daemons that persist for hours or days. A short-lived one-shot script that parses a single malformed record will leak only trivially and exit before exhausting memory; the risk scales with process lifetime and input volume.

Blast radius considerations: a crashed import or feed-processing service can stall downstream pipelines, cause data loss for in-flight records, and force operator intervention. In containerized or memory-capped deployments, exhaustion may trigger pod restarts and cascading failures across a service tier. Because no authentication is inherently required to reach the parsing path (it depends on the application's design), a low-privilege or unauthenticated attacker could sustain enough malformed input to exhaust memory.

No CVSS base score is published in the supplied data. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H is an analyst assessment reflecting network reachability and a low-complexity, no-privilege, no-user-interaction availability attack; it should be treated as provisional until an authoritative score is assigned. EPSS is not available, CISA KEV does not list this CVE, and no exploit code or PoC was observed.

Detection Guidance

Detection for this vulnerability centers on correlated anomalies: repeated CSV parse failures and process memory growth in the same host/service, plus outbound-inbound CSV ingest patterns with abnormally high malformed-record ratios.

Sigma Rule

title: Repeated CSV Parse Failures Followed by Memory Growth in Perl CSV_XS Consumer
id: 8f2a1c3e-1107-54b2-9c00-4b6a1d9f7a21
status: experimental
description: Detects a high rate of malformed CSV parse errors in a Perl process, consistent with CVE-2026-110754 memory-leak denial of service via repeated getline failures.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110754
author: valtersit.com
date: 2026-07-31
logsource:
  product: linux
  category: process_creation
detection:
  sel_perl:
    CommandLine|contains:
      - '.pl'
      - 'perl'
      - 'Text::CSV_XS'
  sel_error:
    Keywords|contains:
      - 'getline'
      - 'CSV'
  condition: sel_perl and sel_error | count() by host > 100 within 10m
falsepositives:
  - Legitimate bulk import of dirty data
level: medium
tags:
  - attack.t1499
  - cve.2026-110754

YARA Rule

rule CVE_2026_110754_Text_CSV_XS_Leak_Version
{
    meta:
        description = "Detects Text::CSV_XS versions before 1.65 via module version string in Perl source/package files"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110754"
        date = "2026-07-31"
    strings:
        $mod = "Text::CSV_XS" ascii wide nocase
        $ver_lo = /\$VERSION\s*=\s*['"]?1\.(?:[0-5][0-9]|[0-5])/ 
        $old_ver = /\$Text::CSV_XS::VERSION\s*=\s*['"]?1\.([0-5][0-9]|[0-5])/
    condition:
        $mod and 1 of ($ver_lo, $old_ver)
}

(Detections should be tuned to the module's actual version banner in production environments.)

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110754 Possible Text::CSV_XS Memory-Leak DoS via Malformed CSV Upload"; flow:to_server,established; http.method; content:"POST"; http.request_body; content:","; content:"\""; pcre:"/^\s*\"[^\"]*$|,\s*\"[^\"]*$/m"; threshold: type both,track by_src, count 200, seconds 60; classtype:attempted-dos; sid:2026110754; rev:1; reference:cve,2026-110754;)

(Heuristic body-inspection rule; exact CSV dialect is application-specific, so adjust the malformed-record pattern to the target's dialect.)

Elastic Detection

sequence by host.name with maxspan=15m
  [process where process.name == "perl" and event.action == "end" and process.exit_code != 0]
  [metric where process.name == "perl" and process.memory.bytes > 500000000]

// Alternative: high-rate CSV parse error events
event where event.category == "process"
  and process.name == "perl"
  and message like~ "*getline*"
  and message like~ "*error*"

(Rules assume process and message telemetry; adapt field names to your Elastic Agent schema.)

Splunk SPL Query

index=os OR index=app sourcetype="*perl*" (message="*getline*" AND (message="*CSV*" OR message="*syntax error*" OR message="*parse error*"))
| stats count by host, process_name
| where count > 100

index=metrics sourcetype="procstat"
| eval mem=tonumber(rss_bytes)
| streamstats window=10 current=t global=f avg(mem) as avg_mem by host
| where mem > avg_mem * 1.5 AND mem > 100000000
| table _time host mem avg_mem

Wazuh OSSEC Rule

<group name="app,csv,dos,">
  <rule id="110754" level="8">
    <decoded_as>json</decoded_as>
    <field name="message">Text::CSV_XS</field>
    <field name="message">getline</field>
    <regex type="pcre2">(?i)(syntax error|parse error|undef)</regex>
    <description>CVE-2026-110754: Text::CSV_XS getline parse failure on malformed CSV record</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
  <rule id="110754" level="10" frequency="100" timeframe="300">
    <if_matched_sid>110754</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-110754: High rate of Text::CSV_XS parse failures - possible memory-leak DoS</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is present in versions before 1.65, implying 1.65 resolves it; however, no vendor advisory or fix commit has been corroborated in the tracked sources, so treat the fix version as an indicator to validate, not a confirmed patch.

1. Immediate mitigations. Constrain and monitor memory on Perl processes that parse untrusted CSV: enforce RSS/working-set limits and per-service memory cgroups so exhaustion is contained, and configure supervisors (systemd, container orchestrators) with restart policies so an OOM-killed worker recovers. Rate-limit CSV ingestion endpoints and cap per-record and total-inbound size. Reject malformed records upstream where possible, and reduce process lifetime via periodic worker recycling (e.g., graceful restart after N records or T time) to bound accumulated leakage. Isolate CSV parsing into disposable, resource-capped workers.

2. Patch / upgrade steps. Upgrade Text::CSV_XS to version 1.65 or later, verify the installed version in each deployment, and rebuild/redeploy any bundled dependency trees. Track the CPAN distribution and NVD record for a confirmed fixed version and advisory before declaring the issue closed.

3. Long-term hardening. Inventory all Perl services that consume untrusted CSV and centralize version management for third-party modules. Add memory-growth and parse-error-rate alerting as a standing control (as in the detection rules above). Treat parser failure paths as an attack surface in code review. Apply least-privilege and resource-quota controls to ingestion workers so degradation in one service does not cascade.

References

• NVD — CVE-2026-110754: https://nvd.nist.gov/vuln/detail/CVE-2026-110754
• MITRE CWE-401 — Missing Release of Memory after Effective Lifetime: https://cwe.mitre.org/data/definitions/401.html
• CPAN — Text::CSV_XS distribution (verify fixed version 1.65): https://metacpan.org/pod/Text::CSV_XS
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CISA KEV: not listed — no known exploited-in-the-wild evidence as of the supplied data. No public PoC or exploit code observed.