Advisories ยป MGASA-2026-0563

Updated perl-Text-CSV_XS package fixes security vulnerabilities

Publication date: 28 Oct 2026
Modification date: 28 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-110752 , CVE-2026-110753 , CVE-2026-110754 , CVE-2026-110755 , CVE-2026-110756 , CVE-2026-110757 , CVE-2026-110758 , CVE-2026-110759

Description

Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by
allocating one entry per index of an RFC 7111 selector in fragment.
(CVE-2026-110752)
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a
use-after-free of bind_columns variables when skip_empty_rows skips an
empty line in getline. (CVE-2026-110753)
Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a
record that fails to parse in getline. (CVE-2026-110754)
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by
copying the unparsed remainder per record of CR-only input in getline.
(CVE-2026-110755)
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and
its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes
in print. (CVE-2026-110756)
Text::CSV_XS versions before 1.65 for Perl allow record splitting by
writing strings used as numbers without quotes in combine.
(CVE-2026-110757)
Text::CSV_XS versions before 1.65 for Perl read before the start of an
all-blank field under allow_whitespace in strip_trail_whitespace.
(CVE-2026-110758)
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is
not in the input for an empty last field followed by a lone CR in parse.
(CVE-2026-110759)

References

SRPMS

10/core