When Text-CSV_XS receives a CSV record that cannot be parsed, the getline routine creates an array of fields, returns undef, and then fails to release the partially built array. Each malformed input therefore adds memory to the process, and the leak accumulates over time. A long-running application that continuously parses untrusted CSV data can eventually exhaust available memory, leading to a crash or severe slowdown. The flaw is a classic memory-leak weakness (CWE-401).

Perl programs that load Text-CSV_XS versions older than 1.65 and invoke getline to parse data. This includes command-line utilities, web services, background workers, or any other process that processes CSV streams from external users. All environments running the vulnerable module – regardless of operating system or deployment model – are at risk.

An EPSS score of 0.00192 indicates a very low exploitation probability, while a CVSS score of 6.5 indicates medium severity. The memory-leak vulnerability can lead to resource exhaustion and denial of service; it does not require privileges. The likely attack vector is feeding a large volume of malformed CSV records from an external source. Because the module is used by various Perl programs that parse CSV from network or file inputs, remote exploitation is feasible. The flaw is not listed in the CISA KEV catalog, and no widespread exploitation is known as of now.