Описание
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.
fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements.
An application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.
A flaw was found in perl-Text-CSV_XS. When parsing fragment selectors, the component pre-allocates array entries for every index in a requested range before reading data and without validating the range bounds against the input. An attacker could exploit this vulnerability by providing a crafted selector with an excessively large range, leading to uncontrolled memory consumption and causing a Denial of Service (DoS).
Отчет
Red Hat Product Security rates this vulnerability as an Important severity impact because unauthenticated remote attackers can trigger an immediate denial of service by causing fatal memory exhaustion in applications processing untrusted CSV queries. In Red Hat Enterprise Linux environments, perl-Text-CSV_XS is provided as a shared library module, restricting exposure to custom or third-party Perl services that accept and pass arbitrary RFC 7111 fragment selectors to the parser. Because the memory allocation failure terminates the running Perl interpreter directly instead of raising a catchable exception, affected services crash completely without the ability to recover.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to validate and restrict numeric upper bounds on row and column fragment selectors prior to invoking Text::CSV_XS fragment or csv routines: upgrade to Text::CSV_XS 1.65+ (or the fixed Perl Text Csv Xs builds), which stores range selectors as coordinate pairs and verifies index membership iteratively instead of preallocating arrays, while clamping cell column boundaries to parsed row lengths, closing all 3 injection vectors (crafted RFC 7111 row selector with large numeric range, crafted RFC 7111 col selector with large numeric range, crafted RFC 7111 cell selector with unclamped column bounds). Until patched, this is a concern on applications and services passing untrusted RFC 7111 fragment selectors to Text::CSV_XS, so strictly restrict or filter user-supplied fragment selectors to reject abnormally large range indices before passing them to fragment or csv parsing calls. As a compensating measure, restrict per-process virtual memory address space using ulimit or prlimit to contain allocation sizes, configure systemd service monitoring with WatchdogSec and automatic Restart to quickly recover from out-of-memory process terminations, and enforce cgroups v2 memory limits to isolate memory consumption and protect host-wide availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying uncontrolled memory allocation defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | perl-Text-CSV_XS | Affected | ||
| Red Hat Enterprise Linux 7 | perl-Text-CSV_XS | Affected | ||
| Red Hat Enterprise Linux 9 | perl-Text-CSV_XS | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements. An application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements. An application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by ...
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements. An application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.
EPSS
7.5 High
CVSS3