{"id":"MGASA-2026-0563","summary":"Updated perl-Text-CSV_XS package fixes security vulnerabilities","details":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by\nallocating one entry per index of an RFC 7111 selector in fragment.\n(CVE-2026-110752)\nText::CSV_XS versions from 1.46 before 1.65 for Perl have a\nuse-after-free of bind_columns variables when skip_empty_rows skips an\nempty line in getline. (CVE-2026-110753)\nText::CSV_XS versions before 1.65 for Perl leak the parsed fields of a\nrecord that fails to parse in getline. (CVE-2026-110754)\nText::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by\ncopying the unparsed remainder per record of CR-only input in getline.\n(CVE-2026-110755)\nText::CSV_XS versions before 1.65 for Perl drop the end of a record and\nits line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes\nin print. (CVE-2026-110756)\nText::CSV_XS versions before 1.65 for Perl allow record splitting by\nwriting strings used as numbers without quotes in combine.\n(CVE-2026-110757)\nText::CSV_XS versions before 1.65 for Perl read before the start of an\nall-blank field under allow_whitespace in strip_trail_whitespace.\n(CVE-2026-110758)\nText::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is\nnot in the input for an empty last field followed by a lone CR in parse.\n(CVE-2026-110759)\n","modified":"2026-10-28T02:15:04.964119640Z","published":"2026-10-28T02:10:00Z","upstream":["CVE-2026-110752","CVE-2026-110753","CVE-2026-110754","CVE-2026-110755","CVE-2026-110756","CVE-2026-110757","CVE-2026-110758","CVE-2026-110759"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2026-0563.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=36532"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2026/10/16/38"},{"type":"WEB","url":"https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes"}],"affected":[{"package":{"name":"perl-Text-CSV_XS","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/perl-Text-CSV_XS?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.650.0-1.mga10"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0563.json"}}],"schema_version":"1.9.2","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}