CVE-2026-110752

{
  "etk_id": "ETK-2026-2452",
  "cve_id": "CVE-2026-110752",
  "display_id": "CVE-2026-110752",
  "ghsa_id": "GHSA-c8hf-63cr-rrfm",
  "euvd_id": "EUVD-2026-103192",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Resource exhaustion in Text::CSV_XS fragment selection",
  "summary": "Text::CSV_XS versions before 1.65 can consume excessive memory when processing RFC 7111 row, column, or cell fragment selectors. An attacker may cause the application process to run out of memory if the application passes attacker-controlled fragment values to the module.",
  "mitigation": "Upgrade Text::CSV_XS to version 1.65 or later. Until upgraded, reject untrusted fragment selectors or impose strict upper limits on their requested ranges.",
  "vendor": null,
  "product": "Text-CSV_XS",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.65"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.65"
      ],
      "package_name": "Text-CSV_XS",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 11.413691916666666,
  "t0_at": "2026-10-16T22:06:03.622000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-16T22:06:03.622000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T22:06:03.622000+00:00",
      "url": "https://github.com/advisories/GHSA-c8hf-63cr-rrfm"
    }
  }
}