The Text-CSV_XS module for Perl has a flaw that causes the program to allocate an array entry for every index specified in an RFC 7111 selector fragment before reading any data. When a large range such as row=1-400000000 is supplied, the module reserves 400 million array elements, exhausting system memory and resulting in an out‑of‑memory error that cannot be caught by eval. This is a classic denial‑of‑service or resource exhaustion vulnerability, identified as CWE‑770.

All installations of the Text-CSV_XS Perl module prior to version 1.65 are affected. Indeed, any version below 1.65 that parses RFC 7111 selector fragments will be prone to this memory exhaustion.

An attacker can trigger the flaw by supplying a malicious fragment in a CSV file that the application processes. If the application receives user‑supplied fragments—such as via a web form or file upload—the attacker can craft a request that causes the module to allocate a huge array, exhausting memory. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the potential for a remote denial‑of‑service remains high, especially in exposed services. The lack of a physical attack vector in the description suggests the attack is feasible in typical use where untrusted input is parsed.