SUSE-SU-2026:5120-1

Dashboard / Vulnerabilities / SUSE-SU-2026:5120-1

SUSE-SU-2026:5120-1

Summary: Security update for perl-Text-CSV_XS

Details: This update for perl-Text-CSV_XS fixes the following issues: - CVE-2026-110752: unclamped RFC 7111 selector range pre-allocation in fragment() can cause memory exhaustion via large index ranges (bsc#1286138). - CVE-2026-110754: unfreed field array memory leak on getline() syntax errors can lead to process memory exhaustion via malformed CSV input (bsc#1286188). - CVE-2026-110755: quadratic buffer copying overhead during CR-only line parsing in getline() can cause CPU exhaustion and denial of service (bsc#1286198). - CVE-2026-110756: invalid UTF-8 bytes during buffer flushes in print() can cause silent field truncation (bsc#1286130). - CVE-2026-110757: unquoted writing of numeric-flagged strings containing newlines in combine() and print() can cause record splitting and row injection (bsc#1286191). - CVE-2026-110758: missing buffer start boundary check in strip_trail_whitespace under allow_whitespace can cause heap out-of-bounds read and memory corruption (bsc#1286137). - CVE-2026-110759: improper end-of-file marker handling after a lone CR can cause Text::CSV_XS to inject an unexpected 0xFF byte (bsc#1286128).

References: https://www.suse.com/support/update/announcement/2026/suse-su-20265120-1/, https://bugzilla.suse.com/1286128, https://bugzilla.suse.com/1286130, https://bugzilla.suse.com/1286137, https://bugzilla.suse.com/1286138, https://bugzilla.suse.com/1286188, https://bugzilla.suse.com/1286191, https://bugzilla.suse.com/1286198, https://www.suse.com/security/cve/CVE-2026-110752, https://www.suse.com/security/cve/CVE-2026-110754, https://www.suse.com/security/cve/CVE-2026-110755, https://www.suse.com/security/cve/CVE-2026-110756, https://www.suse.com/security/cve/CVE-2026-110757, https://www.suse.com/security/cve/CVE-2026-110758, https://www.suse.com/security/cve/CVE-2026-110759