Skip to content
OpenAdvisories
Critical · 9.8 CVE-2026-110756 EUVD-2026-103196GHSA-fvcq-fpcj-xxcc

Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print

Published Oct 16, 2026 · Updated Oct 20, 2026 · Assigned by CPANSec

Description

Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.

When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected.

The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.

Affected products

VendorProductAffectedFixed
— Text-CSV_XS < 1.65 1.65

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libtext-csv-xs-perl 1.65-1 —
Debian 13 libtext-csv-xs-perl No fix yet —
Debian 12 libtext-csv-xs-perl No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 libtext-csv-xs-perl No fix yet —
Ubuntu 26.04 LTS libtext-csv-xs-perl No fix yet —
Ubuntu 24.04 LTS libtext-csv-xs-perl No fix yet —
Ubuntu 22.04 LTS libtext-csv-xs-perl No fix yet —
Ubuntu 20.04 LTS libtext-csv-xs-perl No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS libtext-csv-xs-perl No fix yet —
Ubuntu 16.04 LTS libtext-csv-xs-perl No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP7 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES 15 SP6 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES 15 SP5 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES 15 SP4 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES for SAP 15 SP5 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES for SAP 15 SP4 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLE HPC 15 SP5 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLE HPC 15 SP4 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed perl-Text-CSV_XS 1.650.0-1.1 openSUSE-SU-2026:12218-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 perl-Text-CSV_XS 1.65-1.amzn2023.0.1 ALAS2023-2026-3340
Amazon Linux 2 perl-Text-CSV_XS 1.00-3.amzn2.0.3 ALAS2-2026-4048

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 perl-Text-CSV_XS No fix yet —

Advisories 4

References