Text::CSV_XS versions before 1.65 for Perl (8 CVEs)

Text::CSV_XS before 1.65 can exhaust process memory when it handles an RFC 7111 fragment selector. The fragment() path expands a row= or col= range into one array entry per selected index before it reads any CSV data, and it does not clamp an explicit end column in a cell= selector to the actual row; only range syntax and order are checked. A caller that passes a request-supplied fragment to fragment() or csv() can therefore be forced to allocate a huge array from a tiny input, ending the process with an out-of-memory error that eval cannot catch. Any Perl application using an affected Text::CSV_XS that accepts untrusted fragments is exposed. There is no known public proof of concept and no report of exploitation in the wild.

Do: Upgrade Text::CSV_XS to version 1.65 or later. Until then, do not pass request-supplied or otherwise untrusted RFC 7111 fragment selectors to fragment() or csv(), and bound process memory so an oversized selector cannot take down the host.

Text::CSV_XS for Perl, in versions from 1.46 before 1.65, has a use-after-free (CWE-416) of variables bound with bind_columns when getline skips an empty line. With bind_columns, the parser writes each field into the caller’s own scalar without taking a reference; if skip_empty_rows skips an empty last line, or eof mode skips any empty line, it frees that field scalar without checking whether it is bound and drops a reference the application still holds. Later use of the bound variable then reads freed memory and can crash the process. Applications that parse CSV with this module using bind_columns plus skip_empty_rows or eof mode are affected. No public proof-of-concept is known, the issue is not in CISA KEV, and CVSS has not been scored.

Do: Upgrade Text::CSV_XS to version 1.65 or later. Until then, do not use bind_columns together with skip_empty_rows or eof mode, especially when parsing untrusted CSV, and watch Perl processes that already use that combination for unexpected crashes.

Text::CSV_XS before 1.65 for Perl leaks memory when getline fails to parse a CSV record. On a syntax error, getline returns undef but does not free the array or the fields already collected for that record. A long-running process that parses untrusted CSV therefore retains every malformed record it is sent, and repeated bad input can exhaust its memory (CWE-401), causing a denial of service. Any application using an affected Text::CSV_XS that calls getline on untrusted input is affected. The issue is not in CISA KEV, has no CVSS score yet, and no public proof-of-concept or in-the-wild exploitation is known.

Do: Upgrade Text::CSV_XS to version 1.65 or later. Until then, avoid feeding untrusted CSV to long-running Perl processes that call getline, and watch those processes for unbounded memory growth after parse errors.