Text::CSV_XS EUVD-2026-103194

Requires a persistent, long-running process (e.g. a daemon or web service) that calls Text::CSV_XS->getline() - or getline_all() for the trailing row - on attacker-influenced CSV input, running a version before 1.65. The leak is triggered specifically by records with CSV syntax errors (parse failures returning undef), where the fields parsed before the error are never freed; wide records amplify the per-record leak. Exploitation is LIMITED by: the process must stay alive across many records to accumulate the leak (one-shot scripts that exit reclaim memory), the attacker must be able to feed sustained malformed CSV, and successful memory exhaustion requires a high volume of malformed input rather than a single request.

This is a genuine but moderate-severity availability issue, not a top-priority emergency. The input CVSS of 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) correctly scopes impact to availability only - the CWE-401 memory leak in getline() leaks the parsed fields of records that fail to parse, letting a long-running parser's memory grow without bound. All corroborating exploitation signals point low: EPSS is 0.19% (8th percentile), there is no CISA KEV listing, and no public weaponized exploit was identified. Note two internal tensions in the supplied data: (1) the 'Information Disclosure' tag directly contradicts the CVSS impact vector (C:N/I:N/A:H) - this is a denial-of-service memory exhaustion bug, not an information-disclosure one, so the tag should be treated as mislabeled; and (2) the NVD vector sets UI:R, which is questionable for a service that parses attacker-supplied CSV directly with no human in the loop - verify the UI requirement, as a typical unattended CSV-ingesting service would be UI:N. Real-world risk is bounded by the need for a persistent/long-running process that repeatedly calls getline() (or getline_all) on untrusted input; one-shot scripts that exit are effectively unaffected. Treat as a routine patch-when-convenient item for Perl services ingesting untrusted CSV, not a drop-everything issue.

An attacker repeatedly submits syntactically malformed CSV records to a long-running Perl web service or daemon that uses Text::CSV_XS->getline() on untrusted input. Each failed parse leaks the already-parsed fields of that record instead of freeing them, so sustained malformed input steadily grows the process's resident memory until the host runs out of memory and the service is killed or becomes unresponsive. No public exploit identified at time of analysis, though the vendor's patch ships a regression test that reliably demonstrates the leak growth.