{"id":"CVE-2026-110753","title":"perl-text-csv_xs: perl-text-csv_xs: Denial of Service via use-after-free when parsing empty rows (CVE-2026-110753)","summary":"A flaw was found in perl-text-csv_xs. This flaw allows an attacker who supplies specially crafted CSV input to trigger a Denial of Service (DoS). When processing CSV data configured with bound column variables, the parser improperly releas…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-825","CWE-416","CWE-911"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","affected":["enterprise_linux 10","enterprise_linux 7","enterprise_linux 9"],"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T23:06:18+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-110753.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-110753.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-110753"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554507"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110753"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110753"},{"url":"https://github.com/cpan-authors/Text-CSV_XS/commit/f082d5c8aab1b8d16b6181d4f3042a06947e260f.patch"},{"url":"https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes"}],"tags":["csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-16T22:54:45.851Z","epss":0.00192,"epssPercentile":0.08248,"slug":"CVE-2026-110753","body":"## Overview\n\nA flaw was found in perl-text-csv_xs. This flaw allows an attacker who supplies specially crafted CSV input to trigger a Denial of Service (DoS). When processing CSV data configured with bound column variables, the parser improperly releases memory references upon encountering empty rows. Subsequent access to this freed memory leads to a use-after-free condition, causing the application to crash.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-110753.json)\n\n**perl-text-csv_xs: perl-text-csv_xs: Denial of Service via use-after-free when parsing empty rows** — rated Moderate by Red Hat. Released 2026-10-16.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 9\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 9\n\n## Remediation\n\nFix deferred","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":223715,"id":"CVE-2026-110753","ts":1792238374848,"field":"cvss","old":null,"new":"5.5"},{"seq":223714,"id":"CVE-2026-110753","ts":1792238374848,"field":"severity","old":"none","new":"medium"}]}