Skip to content
OpenAdvisories
High · 7.5 CVE-2026-110758 EUVD-2026-103198GHSA-fxm8-2g6q-9hhf

Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace

Published Oct 16, 2026 · Updated Oct 20, 2026 · Assigned by CPANSec

Description

Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace.

Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there.

Leading blanks are normally skipped before a field is stored, but an all-blank field still arrives after a leading escape_char that differs from quote_char, or as a quoted field in getline when its line ends in two CRs.

Affected products

VendorProductAffectedFixed
— Text-CSV_XS < 1.65 1.65

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libtext-csv-xs-perl 1.65-1 —
Debian 13 libtext-csv-xs-perl No fix yet —
Debian 12 libtext-csv-xs-perl No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 libtext-csv-xs-perl No fix yet —
Ubuntu 26.04 LTS libtext-csv-xs-perl No fix yet —
Ubuntu 24.04 LTS libtext-csv-xs-perl No fix yet —
Ubuntu 22.04 LTS libtext-csv-xs-perl No fix yet —
Ubuntu 20.04 LTS libtext-csv-xs-perl No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS libtext-csv-xs-perl No fix yet —
Ubuntu 16.04 LTS libtext-csv-xs-perl No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP7 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES 15 SP6 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES 15 SP5 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES 15 SP4 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES for SAP 15 SP5 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES for SAP 15 SP4 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLE HPC 15 SP5 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLE HPC 15 SP4 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed perl-Text-CSV_XS 1.650.0-1.1 openSUSE-SU-2026:12218-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 perl-Text-CSV_XS 1.65-1.amzn2023.0.1 ALAS2023-2026-3340
Amazon Linux 2 perl-Text-CSV_XS 1.00-3.amzn2.0.3 ALAS2-2026-4048

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 perl-Text-CSV_XS No fix yet —

Advisories 4

References