Executive brief
Text::CSV_XS is a high-performance Perl library used for processing CSV files. A vulnerability in how it handles custom user-defined functions (callbacks) can lead to memory corruption or application crashes. This could allow an attacker to cause a service outage or potentially execute unauthorized code on systems processing specially crafted data.
Technical details
A use-after-free vulnerability exists in Text::CSV_XS versions prior to 1.62. The Parse, print, getline, and getline_all methods invoke registered callbacks (such as after_parse or on_error) while caching the Perl argument stack pointer. If a callback extends the stack enough to trigger a reallocation, the pointer becomes stale. Subsequent writes through this stale pointer into a freed buffer can result in type confusion, memory corruption, or logic errors where the caller receives the Text::CSV_XS object instead of the expected parsed data. This issue is fixed in version 1.62.
Affected products
- HMBRAND Text::CSV_XS before 1.62
Timeline
- 2026-04-25: patched: Fix committed to public Github repository
- 2026-04-29: disclosed: Advisory published and version 1.62 released
- 2026-06-25: advisory: Debian LTS advisory DLA-4648-1 published
References
- https://cpan.org/modules
- https://github.com/cpan-authors/Text-CSV_XS/commit/c17f31a5f2bf36674748eb4b6e25672f0571a224.patch
- https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.62/changes
- http://www.openwall.com/lists/oss-security/2026/04/29/17
- https://lists.debian.org/debian-lts-announce/2026/06/msg00037.html