[<prev] [next>] [day] [month] [year] [list]
Message-Id: <CDD95EFB-3A8C-4E6A-BEA1-C5FE74E10DBF@stig.io>
Date: Wed, 29 Apr 2026 16:29:03 +0200
From: Stig Palmquist <stig@...g.io>
To: cve-announce@...urity.metacpan.org,
oss-security@...ts.openwall.com
Subject: CVE-2026-7111: Text::CSV_XS versions before 1.62 for Perl have a
use-after-free when registered callbacks extend the Perl argument stack,
which may enable type confusion or memory corruption
========================================================================
CVE-2026-7111 CPAN Security Group
========================================================================
CVE ID: CVE-2026-7111
Distribution: Text-CSV_XS
Versions: before 1.62
MetaCPAN: https://metacpan.org/dist/Text-CSV_XS
VCS Repo: https://github.com/cpan-authors/Text-CSV_XS
Text::CSV_XS versions before 1.62 for Perl have a use-after-free when
registered callbacks extend the Perl argument stack, which may enable
type confusion or memory corruption
Description
-----------
Text::CSV_XS versions before 1.62 for Perl have a use-after-free when
registered callbacks extend the Perl argument stack, which may enable
type confusion or memory corruption.
The Parse, print, getline, and getline_all methods invoke registered
callbacks (for example after_parse, before_print, or on_error) and
cache the Perl argument stack pointer across the call. If a callback
extends the argument stack enough to trigger a reallocation, the return
value is written through the stale pointer into the freed buffer, and
the caller reads the original $self argument as the return value
instead.
Calling code that expects parsed data from getline_all receives the
Text::CSV_XS object in its place, leading to logic errors or crashes.
Text::CSV_XS objects used without any registered callbacks are not
affected.
Problem types
-------------
- CWE-825 Expired Pointer Dereference
- CWE-416 Use After Free
Solutions
---------
Upgrade to 1.62 or later.
References
----------
https://github.com/cpan-authors/Text-CSV_XS/commit/c17f31a5f2bf36674748eb4b6e25672f0571a224.patch
https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.62/changes
Timeline
--------
- 2026-04-25: Fix committed to public Github repository
- 2026-04-26: CVE number reserved
- 2026-04-29: Version 1.62 with the fix released to CPAN
Credits
-------
Leon Timmermans, analyst
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
