{"id":"CVE-2026-110759","aliases":["AZL-109760","DEBIAN-CVE-2026-110759","EUVD-2026-103199","GHSA-v3f5-7p3g-9fm4","MGASA-2026-0563","SUSE-SU-2026:5120-1","UBUNTU-CVE-2026-110759","openSUSE-SU-2026:12218-1"],"status":"published","title":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse","description":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.\n\nWhen the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse(\"a,\\r\") returns the fields \"a\" and \"\\xFF\". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.\n\nA CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00407,"percentile":0.35315,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1286"],"published":"2026-10-16T22:08:23Z","modified":"2026-11-06T12:30:03Z","fixes":[{"ecosystem":"Debian:14","package":"libtext-csv-xs-perl","fixed_in":["1.65-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.60-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.49-1","1.49-1+deb12u1","1.50-1","1.51-1","1.52-1","1.53-1","1.54-1","1.55-1","1.56-1","1.57-1","1.59-1","1.60-1","1.61-1","1.62-1","1.64-1","1.65-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60-1","1.60-1+deb13u1","1.61-1","1.62-1","1.64-1","1.65-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.65-1"}]}],"versions":["1.60-1","1.61-1","1.62-1","1.64-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.650.0-1.mga10"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19-1","1.20-1","1.20-1build1","1.21-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26-1build1","1.34-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.39-1","1.39-1build1","1.40-1","1.41-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.45-1","1.46-1","1.47-1","1.47-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.51-1","1.52-1","1.53-1","1.53-1build1","1.53-1build2","1.53-1build3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.61-1","1.62-1","1.64-1","1.64-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60-1","1.61-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.650.0-1.1"}]}],"bundled":8}],"references":[{"url":"https://github.com/cpan-authors/Text-CSV_XS/commit/7627f1a2bb8ffe4e81d9847318a060822043f7f3.patch","tags":["patch","fix"]},{"url":"https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes","tags":["release-notes","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110759","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-v3f5-7p3g-9fm4"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110759.json","tags":["advisory"]},{"url":"https://github.com/cpan-authors/Text-CSV_XS","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-110759","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0563.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36532","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/16/38","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265120-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1286128","tags":["report"]},{"url":"https://bugzilla.suse.com/1286130","tags":["report"]},{"url":"https://bugzilla.suse.com/1286137","tags":["report"]},{"url":"https://bugzilla.suse.com/1286138","tags":["report"]},{"url":"https://bugzilla.suse.com/1286188","tags":["report"]},{"url":"https://bugzilla.suse.com/1286191","tags":["report"]},{"url":"https://bugzilla.suse.com/1286198","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110759","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-110759","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110759","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/44408696/","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110753","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-110759","title":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse","description":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.\n\nWhen the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse(\"a,\\r\") returns the fields \"a\" and \"\\xFF\". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.\n\nA CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.","status":"published","published":"2026-10-16T22:08:23.781Z","modified":"2026-10-20T18:36:33.803Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-1286"],"updated_at":"2026-11-02T13:34:26.24368Z"}],"euvd":[{"id":"EUVD-2026-103199","description":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.\n\nWhen the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse(\"a,\\r\") returns the fields \"a\" and \"\\xFF\". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.\n\nA CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.","status":"published","published":"2026-10-16T22:08:23Z","modified":"2026-10-20T18:36:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:59:43.145678Z"}],"ghsa":[{"id":"GHSA-v3f5-7p3g-9fm4","title":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an...","description":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.\n\nWhen the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse(\"a,\\r\") returns the fields \"a\" and \"\\xFF\". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.\n\nA CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.","status":"published","published":"2026-10-17T00:31:19Z","modified":"2026-10-20T21:30:44Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1286"],"updated_at":"2026-11-02T15:14:04.750771Z"}],"nvd":[{"id":"CVE-2026-110759","description":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.\n\nWhen the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse(\"a,\\r\") returns the fields \"a\" and \"\\xFF\". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.\n\nA CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.","status":"published","published":"2026-10-16T23:17:01.17Z","modified":"2026-10-20T19:17:30.453Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-1286"],"updated_at":"2026-11-02T14:13:00.123071Z"}],"osv":[{"id":"CVE-2026-110759","title":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse","description":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.\n\nWhen the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse(\"a,\\r\") returns the fields \"a\" and \"\\xFF\". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.\n\nA CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.","status":"published","published":"2026-10-16T22:08:23.781Z","modified":"2026-11-06T12:41:57.945629824Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1286"],"updated_at":"2026-11-06T13:13:38.142189Z"},{"id":"DEBIAN-CVE-2026-110759","description":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.  When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse(\"a,\\r\") returns the fields \"a\" and \"\\xFF\". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.  A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.","status":"published","published":"2026-10-16T23:17:01.17Z","modified":"2026-10-23T18:02:33.545727706Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:49.824149Z"},{"id":"UBUNTU-CVE-2026-110759","description":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse(\"a,\\r\") returns the fields \"a\" and \"\\xFF\". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error. A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.","status":"published","published":"2026-10-16T23:17:00Z","modified":"2026-10-28T20:17:17.40968199Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:59.591851Z"},{"id":"AZL-109760","title":"CVE-2026-110759 affecting package perl-Text-CSV_XS 1.60-1","description":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.\n\nWhen the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse(\"a,\\r\") returns the fields \"a\" and \"\\xFF\". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.\n\nA CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.","status":"published","published":"2026-10-16T23:17:01Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.42484Z"},{"id":"MGASA-2026-0563","title":"Updated perl-Text-CSV_XS package fixes security vulnerabilities","description":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by\nallocating one entry per index of an RFC 7111 selector in fragment.\n(CVE-2026-110752)\nText::CSV_XS versions from 1.46 before 1.65 for Perl have a\nuse-after-free of bind_columns variables when skip_empty_rows skips an\nempty line in getline. (CVE-2026-110753)\nText::CSV_XS versions before 1.65 for Perl leak the parsed fields of a\nrecord that fails to parse in getline. (CVE-2026-110754)\nText::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by\ncopying the unparsed remainder per record of CR-only input in getline.\n(CVE-2026-110755)\nText::CSV_XS versions before 1.65 for Perl drop the end of a record and\nits line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes\nin print. (CVE-2026-110756)\nText::CSV_XS versions before 1.65 for Perl allow record splitting by\nwriting strings used as numbers without quotes in combine.\n(CVE-2026-110757)\nText::CSV_XS versions before 1.65 for Perl read before the start of an\nall-blank field under allow_whitespace in strip_trail_whitespace.\n(CVE-2026-110758)\nText::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is\nnot in the input for an empty last field followed by a lone CR in parse.\n(CVE-2026-110759)\n","status":"published","published":"2026-10-28T02:10:00Z","modified":"2026-10-28T02:15:04.96411964Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12218-1","title":"perl-Text-CSV_XS-1.650.0-1.1 on GA media","description":"These are all security issues fixed in the perl-Text-CSV_XS-1.650.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-21T00:00:00Z","modified":"2026-10-22T17:23:11.300589166Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:5120-1","title":"Security update for perl-Text-CSV_XS","description":"This update for perl-Text-CSV_XS fixes the following issues:\n\n- CVE-2026-110752: unclamped RFC 7111 selector range pre-allocation in fragment() can cause memory exhaustion via large\n  index ranges (bsc#1286138).\n- CVE-2026-110754: unfreed field array memory leak on getline() syntax errors can lead to process memory exhaustion via\n  malformed CSV input (bsc#1286188).\n- CVE-2026-110755: quadratic buffer copying overhead during CR-only line parsing in getline() can cause CPU exhaustion\n  and denial of service (bsc#1286198).\n- CVE-2026-110756: invalid UTF-8 bytes during buffer flushes in print() can cause silent field truncation (bsc#1286130).\n- CVE-2026-110757: unquoted writing of numeric-flagged strings containing newlines in combine() and print() can cause\n  record splitting and row injection (bsc#1286191).\n- CVE-2026-110758: missing buffer start boundary check in strip_trail_whitespace under allow_whitespace can cause heap\n  out-of-bounds read and memory corruption (bsc#1286137).\n- CVE-2026-110759: improper end-of-file marker handling after a lone CR can cause Text::CSV_XS to inject an unexpected\n  0xFF byte (bsc#1286128).\n","status":"published","published":"2026-11-05T12:19:29Z","modified":"2026-11-06T12:30:03.490751417Z","updated_at":"2026-11-06T12:43:06.926783Z"}]}}