CVE-2026-110759

Received Received - Intake

Text::CSV_XS End-of-Field CR Handling Issue

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: CPANSec

Description

Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error. A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-110759

EUVD

EUVD-2026-103199

Affected Vendors & Products

Vendor	Product	Version / Range
perl	text	to 1.65 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1286	The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.

Attack-Flow Graph

Executive Summary

Text::CSV_XS versions before 1.65 for Perl incorrectly handle empty last fields followed by a lone CR character. When parsing input ending with a separator and CR, it appends a 0xFF byte not present in the original input as the last field. This occurs because the parser misinterprets the end-of-file marker as a valid character.

Detection Guidance

This vulnerability affects Perl's Text::CSV_XS module versions before 1.65. To detect it, check the installed version of Text::CSV_XS using the command: perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION' If the version is less than 1.65, the system is vulnerable.

Impact Analysis

This vulnerability may cause applications to process malformed data, including unexpected bytes like 0xFF, leading to incorrect behavior or crashes. It specifically affects files read line by line where the last column is empty, potentially corrupting data integrity or causing parsing errors.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a specific parsing issue in Perl's Text::CSV_XS module. There is no evidence in the provided context that this issue leads to data breaches or unauthorized access, which are primary concerns for these regulations.

Mitigation Strategies

Update Text::CSV_XS to version 1.65 or later using your package manager, such as: cpan Text::CSV_XS or cpanm Text::CSV_XS. If updating is not possible, review input handling in applications using this module to ensure proper validation of parsed fields.

Hi! I’m here to help you understand CVE-2026-110759. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70