---
id: CVE-2026-110752
title: >-
  perl-Text-CSV_XS: perl-Text-CSV_XS: Denial of Service via excessive memory
  allocation in fragment selector (CVE-2026-110752)
summary: >-
  A flaw was found in perl-Text-CSV_XS. When parsing fragment selectors, the
  component pre-allocates array entries for every index in a requested range
  before reading data and without validating the range bounds against the input.
  An attacke…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-770
vendor: Red Hat
product: Red Hat Enterprise Linux 10
affected:
  - enterprise_linux 10
  - enterprise_linux 7
  - enterprise_linux 9
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T23:01:49+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-110752.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-110752.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-110752'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2554509'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-110752'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110752'
  - url: >-
      https://github.com/cpan-authors/Text-CSV_XS/commit/d9d3d66f9ff6a8a1bc255a6ef05100f9b102b92b.patch
  - url: 'https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
ingestedAt: '2026-10-16T22:54:45.853Z'
epss: 0.00192
epssPercentile: 0.08249
---

## Overview

A flaw was found in perl-Text-CSV_XS. When parsing fragment selectors, the component pre-allocates array entries for every index in a requested range before reading data and without validating the range bounds against the input. An attacker could exploit this vulnerability by providing a crafted selector with an excessively large range, leading to uncontrolled memory consumption and causing a Denial of Service (DoS).

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-110752.json)

**perl-Text-CSV_XS: perl-Text-CSV_XS: Denial of Service via excessive memory allocation in fragment selector** — rated Important by Red Hat. Released 2026-10-16.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 9

No fix planned:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 9

## Remediation

Affected