AI analysis
Text::CSV_XS before 1.65 for Perl leaks memory when getline fails to parse a CSV record. On a syntax error, getline returns undef but does not free the array or the fields already collected for that record. A long-running process that parses untrusted CSV therefore retains every malformed record it is sent, and repeated bad input can exhaust its memory (CWE-401), causing a denial of service. Any application using an affected Text::CSV_XS that calls getline on untrusted input is affected. The issue is not in CISA KEV, has no CVSS score yet, and no public proof-of-concept or in-the-wild exploitation is known.
What to do: Upgrade Text::CSV_XS to version 1.65 or later. Until then, avoid feeding untrusted CSV to long-running Perl processes that call getline, and watch those processes for unbounded memory growth after parse errors.
Affected
| H.M. Brand Text::CSV_XS | before 1.65 |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error. A long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.