{"id":"SUSE-SU-2026:5120-1","summary":"Security update for perl-Text-CSV_XS","details":"This update for perl-Text-CSV_XS fixes the following issues:\n\n- CVE-2026-110752: unclamped RFC 7111 selector range pre-allocation in fragment() can cause memory exhaustion via large\n  index ranges (bsc#1286138).\n- CVE-2026-110754: unfreed field array memory leak on getline() syntax errors can lead to process memory exhaustion via\n  malformed CSV input (bsc#1286188).\n- CVE-2026-110755: quadratic buffer copying overhead during CR-only line parsing in getline() can cause CPU exhaustion\n  and denial of service (bsc#1286198).\n- CVE-2026-110756: invalid UTF-8 bytes during buffer flushes in print() can cause silent field truncation (bsc#1286130).\n- CVE-2026-110757: unquoted writing of numeric-flagged strings containing newlines in combine() and print() can cause\n  record splitting and row injection (bsc#1286191).\n- CVE-2026-110758: missing buffer start boundary check in strip_trail_whitespace under allow_whitespace can cause heap\n  out-of-bounds read and memory corruption (bsc#1286137).\n- CVE-2026-110759: improper end-of-file marker handling after a lone CR can cause Text::CSV_XS to inject an unexpected\n  0xFF byte (bsc#1286128).\n","modified":"2026-11-06T12:30:03.490751417Z","published":"2026-11-05T12:19:29Z","related":["CVE-2026-110752","CVE-2026-110754","CVE-2026-110755","CVE-2026-110756","CVE-2026-110757","CVE-2026-110758","CVE-2026-110759"],"upstream":["CVE-2026-110752","CVE-2026-110754","CVE-2026-110755","CVE-2026-110756","CVE-2026-110757","CVE-2026-110758","CVE-2026-110759"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265120-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286128"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286130"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286137"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286138"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286188"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286191"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286198"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110752"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110754"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110755"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110756"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110757"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110758"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110759"}],"affected":[{"package":{"name":"perl-Text-CSV_XS","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","purl":"pkg:rpm/suse/perl-Text-CSV_XS&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"ecosystem_specific":{"binaries":[{"perl-Text-CSV_XS":"1.34-150000.3.6.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5120-1.json"}},{"package":{"name":"perl-Text-CSV_XS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","purl":"pkg:rpm/suse/perl-Text-CSV_XS&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"ecosystem_specific":{"binaries":[{"perl-Text-CSV_XS":"1.34-150000.3.6.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5120-1.json"}},{"package":{"name":"perl-Text-CSV_XS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","purl":"pkg:rpm/suse/perl-Text-CSV_XS&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"ecosystem_specific":{"binaries":[{"perl-Text-CSV_XS":"1.34-150000.3.6.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5120-1.json"}},{"package":{"name":"perl-Text-CSV_XS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","purl":"pkg:rpm/suse/perl-Text-CSV_XS&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"ecosystem_specific":{"binaries":[{"perl-Text-CSV_XS":"1.34-150000.3.6.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5120-1.json"}},{"package":{"name":"perl-Text-CSV_XS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","purl":"pkg:rpm/suse/perl-Text-CSV_XS&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"ecosystem_specific":{"binaries":[{"perl-Text-CSV_XS":"1.34-150000.3.6.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5120-1.json"}},{"package":{"name":"perl-Text-CSV_XS","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","purl":"pkg:rpm/suse/perl-Text-CSV_XS&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"ecosystem_specific":{"binaries":[{"perl-Text-CSV_XS":"1.34-150000.3.6.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5120-1.json"}},{"package":{"name":"perl-Text-CSV_XS","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","purl":"pkg:rpm/suse/perl-Text-CSV_XS&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"ecosystem_specific":{"binaries":[{"perl-Text-CSV_XS":"1.34-150000.3.6.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5120-1.json"}},{"package":{"name":"perl-Text-CSV_XS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","purl":"pkg:rpm/suse/perl-Text-CSV_XS&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"ecosystem_specific":{"binaries":[{"perl-Text-CSV_XS":"1.34-150000.3.6.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5120-1.json"}},{"package":{"name":"perl-Text-CSV_XS","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","purl":"pkg:rpm/suse/perl-Text-CSV_XS&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"ecosystem_specific":{"binaries":[{"perl-Text-CSV_XS":"1.34-150000.3.6.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5120-1.json"}},{"package":{"name":"perl-Text-CSV_XS","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","purl":"pkg:rpm/suse/perl-Text-CSV_XS&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"ecosystem_specific":{"binaries":[{"perl-Text-CSV_XS":"1.34-150000.3.6.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5120-1.json"}},{"package":{"name":"perl-Text-CSV_XS","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","purl":"pkg:rpm/suse/perl-Text-CSV_XS&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"ecosystem_specific":{"binaries":[{"perl-Text-CSV_XS":"1.34-150000.3.6.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5120-1.json"}}],"schema_version":"1.9.2"}