The notice was published on October 16, 2026 by Stig Palmquist on the oss-sec list and mentions eight CVE identifiers related to Text::CSV_XS, a Perl module for reading and writing CSV files. According to the available excerpt, versions before 1.65 allow memory exhaustion when allocating an entry for each index of an RFC 7111 selector in the fragment (CVE-2026-110752). Another item, CVE-2026-110753, describes a use-after-free of bind_columns variables in versions from 1.46 up to before 1.65, when skip_empty_rows skips an empty line in getline. CVE-2026-110754 concerns leakage of the parsed fields of a record that cannot be processed, in versions before 1.65. The received text ends in the middle of that description, and the remaining identifiers were not included.
The material is a machine translation of a message from the oss-sec feed. Therefore, technical names and version details should be checked against the original source before any decision. To consult the full notice, open the public oss-sec archive referenced in the original message, locate the October 16, 2026 date, and compare each CVE with the official vulnerability database and the Text::CSV_XS release notes. Version 1.65 appears as the first fixed release in the excerpts received.