CVE-2026-110752 HMBRAND CVE debrief

Who should care

Defenders who use Text::CSV_XS in their applications should verify the version in use and upgrade to version 1.65 or later if necessary. Developers who use Text::CSV_XS in their applications should review their code to ensure that user-supplied input is properly validated and sanitized before being passed to the fragment or csv functions.

Why it matters

CVE-2026-110752 is a vulnerability in Text::CSV_XS versions before 1.65 for Perl, which allows memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. Defenders should prioritize verifying the version of Text::CSV_XS in use and upgrading to version 1.65 or later if necessary.

• Memory exhaustion can lead to an Out of memory error that eval cannot catch, causing the process to terminate.
• Defenders should verify the version of Text::CSV_XS in use and upgrade to version 1.65 or later if necessary to prevent memory exhaustion.
• Developers should review application code to ensure that user-supplied input is properly validated and sanitized before being passed to the fragment or csv functions.

Technical summary

The vulnerability is caused by the fragment expanding a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. This can lead to memory exhaustion and an Out of memory error that eval cannot catch. The issue can be triggered by passing a request-supplied fragment to fragment or csv, which can cause the process to terminate. Defenders should prioritize verifying the version of Text::CSV_XS in use and upgrading to version 1.65 or later if necessary.

Defensive priority

Defenders should prioritize verifying the version of Text::CSV_XS in use and upgrading to version 1.65 or later if necessary.

Recommended defensive actions

• Verify the version of Text::CSV_XS in use and upgrade to version 1.65 or later if necessary.
• Review application code to ensure that user-supplied input is properly validated and sanitized before being passed to the fragment or csv functions.
• Implement memory limits and monitoring to detect potential memory exhaustion attacks.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The evidence for this vulnerability comes from the CVE Program record and the NIST National Vulnerability Database. The CVE record was published on 2026-10-16T23:17:00.410Z and has not been modified since then. Defenders should verify the version of Text::CSV_XS in use and review application code to ensure that user-supplied input is properly validated and sanitized.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.