CVE-2026-110759
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.
When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.
A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.
When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.
A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.
- Record
CVE-2026-110759- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1286
- Updated
- 2026-11-02
EUVDEUVD-2026-103199
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.
When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.
A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.
- Record
EUVD-2026-103199- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-v3f5-7p3g-9fm4
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an...
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.
When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.
A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.
- Record
GHSA-v3f5-7p3g-9fm4- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1286
- Updated
- 2026-11-02
NVD
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.
When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.
A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.
- Record
CVE-2026-110759- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1286
- Updated
- 2026-11-02
OSV
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.
When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.
A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.
- Record
CVE-2026-110759- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1286
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-110759
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error. A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.
- Record
DEBIAN-CVE-2026-110759- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2026-110759
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error. A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.
- Record
UBUNTU-CVE-2026-110759- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-109760 No score
CVE-2026-110759 affecting package perl-Text-CSV_XS 1.60-1
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.
When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.
A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.
- Record
AZL-109760- Updated
- 2026-11-05
OSVMGASA-2026-0563 No score
Updated perl-Text-CSV_XS package fixes security vulnerabilities
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. (CVE-2026-110752) Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. (CVE-2026-110753) Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. (CVE-2026-110754) Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. (CVE-2026-110755) Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. (CVE-2026-110756) Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. (CVE-2026-110757) Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace. (CVE-2026-110758) Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. (CVE-2026-110759)
- Record
MGASA-2026-0563- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12218-1 No score
perl-Text-CSV_XS-1.650.0-1.1 on GA media
These are all security issues fixed in the perl-Text-CSV_XS-1.650.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12218-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:5120-1 No score
Security update for perl-Text-CSV_XS
This update for perl-Text-CSV_XS fixes the following issues:
- CVE-2026-110752: unclamped RFC 7111 selector range pre-allocation in fragment() can cause memory exhaustion via large index ranges (bsc#1286138).
- CVE-2026-110754: unfreed field array memory leak on getline() syntax errors can lead to process memory exhaustion via malformed CSV input (bsc#1286188).
- CVE-2026-110755: quadratic buffer copying overhead during CR-only line parsing in getline() can cause CPU exhaustion and denial of service (bsc#1286198).
- CVE-2026-110756: invalid UTF-8 bytes during buffer flushes in print() can cause silent field truncation (bsc#1286130).
- CVE-2026-110757: unquoted writing of numeric-flagged strings containing newlines in combine() and print() can cause record splitting and row injection (bsc#1286191).
- CVE-2026-110758: missing buffer start boundary check in strip_trail_whitespace under allow_whitespace can cause heap out-of-bounds read and memory corruption (bsc#1286137).
- CVE-2026-110759: improper end-of-file marker handling after a lone CR can cause Text::CSV_XS to inject an unexpected 0xFF byte (bsc#1286128).
- Record
SUSE-SU-2026:5120-1- Updated
- 2026-11-06
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perl-Text-CSV_XSAzure Linux:3 |
through 1.60-1 | None known |
libtext-csv-xs-perlDebian:12 |
All versions, plus listed versions 1.49-11.49-1+deb12u11.50-11.51-11.52-1 Show 11 moreShow less1.53-11.54-11.55-11.56-11.57-11.59-11.60-11.61-11.62-11.64-11.65-1 |
None known |
libtext-csv-xs-perlDebian:13 |
All versions, plus listed versions 1.60-11.60-1+deb13u11.61-11.62-11.64-11.65-1 |
None known |
libtext-csv-xs-perlDebian:14 |
before 1.65-1, plus listed versions 1.60-11.61-11.62-11.64-1 |
1.65-1 |
perl-Text-CSV_XSMageia:10 From an advisory covering 8 CVEs |
before 1.650.0-1.mga10 | 1.650.0-1.mga10 |
perl-Text-CSV_XSSUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
perl-Text-CSV_XSSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
perl-Text-CSV_XSSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
perl-Text-CSV_XSSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
perl-Text-CSV_XSSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
perl-Text-CSV_XSSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
perl-Text-CSV_XSSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
perl-Text-CSV_XSSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
perl-Text-CSV_XSSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
perl-Text-CSV_XSSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
perl-Text-CSV_XSSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 7 CVEs |
before 1.34-150000.3.6.1 | 1.34-150000.3.6.1 |
libtext-csv-xs-perlUbuntu:16.04:LTS |
All versions, plus listed versions 1.19-11.20-11.20-1build11.21-1 |
None known |
libtext-csv-xs-perlUbuntu:18.04:LTS |
All versions, plus listed versions 1.26-1build11.34-1 |
None known |
libtext-csv-xs-perlUbuntu:20.04:LTS |
All versions, plus listed versions 1.39-11.39-1build11.40-11.41-1 |
None known |
libtext-csv-xs-perlUbuntu:22.04:LTS |
All versions, plus listed versions 1.45-11.46-11.47-11.47-1build1 |
None known |
libtext-csv-xs-perlUbuntu:24.04:LTS |
All versions, plus listed versions 1.51-11.52-11.53-11.53-1build11.53-1build21.53-1build3 |
None known |
libtext-csv-xs-perlUbuntu:26.10 |
All versions, plus listed versions 1.61-11.62-11.64-11.64-1build1 |
None known |
libtext-csv-xs-perlUbuntu:26.04:LTS |
All versions, plus listed versions 1.60-11.61-1 |
None known |
perl-Text-CSV_XSopenSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 1.650.0-1.1 | 1.650.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-110759 is a critical vulnerability (CVSS 9.8) in perl-Text-CSV_XS, published October 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in libtext-csv-xs-perl 1.65-1.
References
github.com/cpan-authors/Text-CSV_XS/commit/7627f1a2bb8ffe4e81d9847318a060822043f7f3.patch
metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes
nvd.nist.gov/vuln/detail/CVE-2026-110759
cpan.org/modules
Show 24 moreShow less
security-tracker.debian.org/tracker/CVE-2026-110759
advisories.mageia.org/MGASA-2026-0563.html
bugs.mageia.org/show_bug.cgi?id=36532
openwall.com/lists/oss-security/2026/10/16/38
suse.com/support/update/announcement/2026/suse-su-20265120-1
bugzilla.suse.com/1286128
ubuntu.com/security/CVE-2026-110759
cve.org/CVERecord?id=CVE-2026-110759
lists.security.metacpan.org/cve-announce/msg/44408696