CVE-2026-7111

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7111", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-04-26T15:31:25.111Z", "datePublished": "2026-04-29T14:22:29.358Z", "dateUpdated": "2026-06-25T19:35:17.533Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Text-CSV_XS", "product": "Text::CSV_XS", "programFiles": ["CSV_XS.xs"], "programRoutines": [{"name": "Text::CSV_XS::Parse"}, {"name": "Text::CSV_XS::print"}, {"name": "Text::CSV_XS::getline"}, {"name": "Text::CSV_XS::getline_all"}], "repo": "https://github.com/cpan-authors/Text-CSV_XS", "vendor": "HMBRAND", "versions": [{"lessThan": "1.62", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "analyst", "value": "Leon Timmermans"}], "descriptions": [{"lang": "en", "value": "Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption.\n\nThe Parse, print, getline, and getline_all methods invoke registered callbacks (for example after_parse, before_print, or on_error) and cache the Perl argument stack pointer across the call. If a callback extends the argument stack enough to trigger a reallocation, the return value is written through the stale pointer into the freed buffer, and the caller reads the original $self argument as the return value instead.\n\nCalling code that expects parsed data from getline_all receives the Text::CSV_XS object in its place, leading to logic errors or crashes. Text::CSV_XS objects used without any registered callbacks are not affected."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-825", "description": "CWE-825 Expired Pointer Dereference", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-04-29T14:22:29.358Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/cpan-authors/Text-CSV_XS/commit/c17f31a5f2bf36674748eb4b6e25672f0571a224.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.62/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to 1.62 or later."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-04-25T00:00:00.000Z", "value": "Fix committed to public Github repository"}, {"lang": "en", "time": "2026-04-26T00:00:00.000Z", "value": "CVE number reserved"}, {"lang": "en", "time": "2026-04-29T00:00:00.000Z", "value": "Version 1.62 with the fix released to CPAN"}], "title": "Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/29/17"}, {"url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00037.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-25T19:35:17.533Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-29T17:49:05.158465Z", "id": "CVE-2026-7111", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-29T17:49:17.981Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/29/17"}, {"url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00037.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-25T19:35:17.533Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-7111", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-29T17:49:05.158465Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-29T17:48:34.378Z"}}], "cna": {"title": "Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "analyst", "value": "Leon Timmermans"}], "affected": [{"repo": "https://github.com/cpan-authors/Text-CSV_XS", "vendor": "HMBRAND", "product": "Text::CSV_XS", "versions": [{"status": "affected", "version": "0", "lessThan": "1.62", "versionType": "custom"}], "packageName": "Text-CSV_XS", "programFiles": ["CSV_XS.xs"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Text::CSV_XS::Parse"}, {"name": "Text::CSV_XS::print"}, {"name": "Text::CSV_XS::getline"}, {"name": "Text::CSV_XS::getline_all"}]}], "timeline": [{"lang": "en", "time": "2026-04-25T00:00:00.000Z", "value": "Fix committed to public Github repository"}, {"lang": "en", "time": "2026-04-26T00:00:00.000Z", "value": "CVE number reserved"}, {"lang": "en", "time": "2026-04-29T00:00:00.000Z", "value": "Version 1.62 with the fix released to CPAN"}], "solutions": [{"lang": "en", "value": "Upgrade to 1.62 or later."}], "references": [{"url": "https://github.com/cpan-authors/Text-CSV_XS/commit/c17f31a5f2bf36674748eb4b6e25672f0571a224.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.62/changes", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption.\n\nThe Parse, print, getline, and getline_all methods invoke registered callbacks (for example after_parse, before_print, or on_error) and cache the Perl argument stack pointer across the call. If a callback extends the argument stack enough to trigger a reallocation, the return value is written through the stale pointer into the freed buffer, and the caller reads the original $self argument as the return value instead.\n\nCalling code that expects parsed data from getline_all receives the Text::CSV_XS object in its place, leading to logic errors or crashes. Text::CSV_XS objects used without any registered callbacks are not affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-825", "description": "CWE-825 Expired Pointer Dereference"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-04-29T14:22:29.358Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7111", "state": "PUBLISHED", "dateUpdated": "2026-06-25T19:35:17.533Z", "dateReserved": "2026-04-26T15:31:25.111Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-04-29T14:22:29.358Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Text-CSV_XS", "product": "Text::CSV_XS", "programFiles": ["CSV_XS.xs"], "programRoutines": [{"name": "Text::CSV_XS::Parse"}, {"name": "Text::CSV_XS::print"}, {"name": "Text::CSV_XS::getline"}, {"name": "Text::CSV_XS::getline_all"}], "repo": "https://github.com/cpan-authors/Text-CSV_XS", "vendor": "HMBRAND", "versions": [{"lessThan": "1.62", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hmbrand:text\\:\\:csv_xs:*:*:*:*:*:perl:*:*", "matchCriteriaId": "42D9FCD4-72E4-4E7D-B842-1DF319D08DF0", "versionEndExcluding": "1.62", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption.\n\nThe Parse, print, getline, and getline_all methods invoke registered callbacks (for example after_parse, before_print, or on_error) and cache the Perl argument stack pointer across the call. If a callback extends the argument stack enough to trigger a reallocation, the return value is written through the stale pointer into the freed buffer, and the caller reads the original $self argument as the return value instead.\n\nCalling code that expects parsed data from getline_all receives the Text::CSV_XS object in its place, leading to logic errors or crashes. Text::CSV_XS objects used without any registered callbacks are not affected."}, {"lang": "es", "value": "Las versiones de Text::CSV_XS anteriores a la 1.62 para Perl tienen un uso despu\u00e9s de liberaci\u00f3n cuando las devoluciones de llamada registradas extienden la pila de argumentos de Perl, lo que puede permitir confusi\u00f3n de tipos o corrupci\u00f3n de memoria.\n\nLos m\u00e9todos Parse, print, getline y getline_all invocan devoluciones de llamada registradas (por ejemplo, after_parse, before_print o on_error) y almacenan en cach\u00e9 el puntero de la pila de argumentos de Perl durante la llamada. Si una devoluci\u00f3n de llamada extiende la pila de argumentos lo suficiente como para activar una reasignaci\u00f3n, el valor de retorno se escribe a trav\u00e9s del puntero obsoleto en el b\u00fafer liberado, y el llamador lee el argumento $self original como el valor de retorno en su lugar.\n\nEl c\u00f3digo que llama y espera datos analizados de getline_all recibe el objeto Text::CSV_XS en su lugar, lo que lleva a errores de l\u00f3gica o fallos. Los objetos Text::CSV_XS utilizados sin ninguna devoluci\u00f3n de llamada registrada no se ven afectados."}], "id": "CVE-2026-7111", "lastModified": "2026-10-26T20:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7111", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-29T17:49:05.158465Z", "version": "2.0.3"}}]}, "published": "2026-04-29T15:16:09.183", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Mailing List", "Patch"], "url": "https://github.com/cpan-authors/Text-CSV_XS/commit/c17f31a5f2bf36674748eb4b6e25672f0571a224.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Product", "Release Notes"], "url": "https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.62/changes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/04/29/17"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00037.html"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}, {"lang": "en", "value": "CWE-825"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.62)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Text::CSV_XS", "source": "cna", "vendor": "HMBRAND"}, "product": "text::csv_xs", "vendor": "hmbrand"}], "created": "2026-04-30T08:21:10.417350+00:00", "updated": "2026-04-30T14:15:40.608185+00:00", "vendors": ["hmbrand", "hmbrand$PRODUCT$text::csv_xs"]}