CVE-2026-110756
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.
When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected.
The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.
When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected.
The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.
- Record
CVE-2026-110756- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-116
- Updated
- 2026-11-02
EUVDEUVD-2026-103196
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.
When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected.
The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.
- Record
EUVD-2026-103196- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fvcq-fpcj-xxcc
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a...
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.
When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected.
The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.
- Record
GHSA-fvcq-fpcj-xxcc- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-116
- Updated
- 2026-11-02
NVD
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.
When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected.
The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.
- Record
CVE-2026-110756- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-116
- Updated
- 2026-11-02
OSV
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.
When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected.
The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.
- Record
CVE-2026-110756- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-116
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-110756
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected. The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.
- Record
DEBIAN-CVE-2026-110756- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2026-110756
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected. The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.
- Record
UBUNTU-CVE-2026-110756- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-109742 No score
CVE-2026-110756 affecting package perl-Text-CSV_XS 1.60-1
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.
When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected.
The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.
- Record
AZL-109742- Updated
- 2026-11-05
OSVMGASA-2026-0563 No score
Updated perl-Text-CSV_XS package fixes security vulnerabilities
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. (CVE-2026-110752) Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. (CVE-2026-110753) Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. (CVE-2026-110754) Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. (CVE-2026-110755) Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. (CVE-2026-110756) Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. (CVE-2026-110757) Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace. (CVE-2026-110758) Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. (CVE-2026-110759)
- Record
MGASA-2026-0563- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12218-1 No score
perl-Text-CSV_XS-1.650.0-1.1 on GA media
These are all security issues fixed in the perl-Text-CSV_XS-1.650.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12218-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:5120-1 No score
Security update for perl-Text-CSV_XS
This update for perl-Text-CSV_XS fixes the following issues:
- CVE-2026-110752: unclamped RFC 7111 selector range pre-allocation in fragment() can cause memory exhaustion via large index ranges (bsc#1286138).
- CVE-2026-110754: unfreed field array memory leak on getline() syntax errors can lead to process memory exhaustion via malformed CSV input (bsc#1286188).
- CVE-2026-110755: quadratic buffer copying overhead during CR-only line parsing in getline() can cause CPU exhaustion and denial of service (bsc#1286198).
- CVE-2026-110756: invalid UTF-8 bytes during buffer flushes in print() can cause silent field truncation (bsc#1286130).
- CVE-2026-110757: unquoted writing of numeric-flagged strings containing newlines in combine() and print() can cause record splitting and row injection (bsc#1286191).
- CVE-2026-110758: missing buffer start boundary check in strip_trail_whitespace under allow_whitespace can cause heap out-of-bounds read and memory corruption (bsc#1286137).
- CVE-2026-110759: improper end-of-file marker handling after a lone CR can cause Text::CSV_XS to inject an unexpected 0xFF byte (bsc#1286128).
- Record
SUSE-SU-2026:5120-1- Updated
- 2026-11-06
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perl-Text-CSV_XSAzure Linux:3 |
through 1.60-1 | None known |
libtext-csv-xs-perlDebian:12 |
All versions, plus listed versions 1.49-11.49-1+deb12u11.50-11.51-11.52-1 Show 11 moreShow less1.53-11.54-11.55-11.56-11.57-11.59-11.60-11.61-11.62-11.64-11.65-1 |
None known |
libtext-csv-xs-perlDebian:13 |
All versions, plus listed versions 1.60-11.60-1+deb13u11.61-11.62-11.64-11.65-1 |
None known |
libtext-csv-xs-perlDebian:14 |
before 1.65-1, plus listed versions 1.60-11.61-11.62-11.64-1 |
1.65-1 |
perl-Text-CSV_XSMageia:10 From an advisory covering 8 CVEs |
before 1.650.0-1.mga10 | 1.650.0-1.mga10 |
perl-Text-CSV_XSSUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
perl-Text-CSV_XSSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
perl-Text-CSV_XSSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
perl-Text-CSV_XSSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
perl-Text-CSV_XSSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
perl-Text-CSV_XSSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
perl-Text-CSV_XSSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
perl-Text-CSV_XSSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
perl-Text-CSV_XSSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
perl-Text-CSV_XSSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
perl-Text-CSV_XSSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
libtext-csv-xs-perlUbuntu:16.04:LTS |
All versions, plus listed versions 1.19-11.20-11.20-1build11.21-1 |
None known |
libtext-csv-xs-perlUbuntu:18.04:LTS |
All versions, plus listed versions 1.26-1build11.34-1 |
None known |
libtext-csv-xs-perlUbuntu:20.04:LTS |
All versions, plus listed versions 1.39-11.39-1build11.40-11.41-1 |
None known |
libtext-csv-xs-perlUbuntu:22.04:LTS |
All versions, plus listed versions 1.45-11.46-11.47-11.47-1build1 |
None known |
libtext-csv-xs-perlUbuntu:24.04:LTS |
All versions, plus listed versions 1.51-11.52-11.53-11.53-1build11.53-1build21.53-1build3 |
None known |
libtext-csv-xs-perlUbuntu:26.10 |
All versions, plus listed versions 1.61-11.62-11.64-11.64-1build1 |
None known |
libtext-csv-xs-perlUbuntu:26.04:LTS |
All versions, plus listed versions 1.60-11.61-1 |
None known |
perl-Text-CSV_XSopenSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 1.650.0-1.1 | 1.650.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-110756 is a critical vulnerability (CVSS 9.8) in perl-Text-CSV_XS, published October 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in libtext-csv-xs-perl 1.65-1.
References
github.com/cpan-authors/Text-CSV_XS/commit/0610a8d81262ae6f1ac82a88d73c8a471f38af19.patch
metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes
nvd.nist.gov/vuln/detail/CVE-2026-110756
cpan.org/modules
Show 24 moreShow less
security-tracker.debian.org/tracker/CVE-2026-110756
advisories.mageia.org/MGASA-2026-0563.html
bugs.mageia.org/show_bug.cgi?id=36532
openwall.com/lists/oss-security/2026/10/16/38
suse.com/support/update/announcement/2026/suse-su-20265120-1
bugzilla.suse.com/1286128
ubuntu.com/security/CVE-2026-110756
cve.org/CVERecord?id=CVE-2026-110756
lists.security.metacpan.org/cve-announce/msg/44408690