Skip to content
OpenAdvisories
Critical · 9.8 CVE-2026-110759 EUVD-2026-103199GHSA-v3f5-7p3g-9fm4

Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse

Published Oct 16, 2026 · Updated Oct 20, 2026 · Assigned by CPANSec

Description

Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.

When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.

A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.

Affected products

VendorProductAffectedFixed
— Text-CSV_XS < 1.65 1.65

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libtext-csv-xs-perl 1.65-1 —
Debian 13 libtext-csv-xs-perl No fix yet —
Debian 12 libtext-csv-xs-perl No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 libtext-csv-xs-perl No fix yet —
Ubuntu 26.04 LTS libtext-csv-xs-perl No fix yet —
Ubuntu 24.04 LTS libtext-csv-xs-perl No fix yet —
Ubuntu 22.04 LTS libtext-csv-xs-perl No fix yet —
Ubuntu 20.04 LTS libtext-csv-xs-perl No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS libtext-csv-xs-perl No fix yet —
Ubuntu 16.04 LTS libtext-csv-xs-perl No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP7 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES 15 SP6 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES 15 SP5 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES 15 SP4 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES for SAP 15 SP5 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES for SAP 15 SP4 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLE HPC 15 SP5 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLE HPC 15 SP4 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed perl-Text-CSV_XS 1.650.0-1.1 openSUSE-SU-2026:12218-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 perl-Text-CSV_XS 1.65-1.amzn2023.0.1 ALAS2023-2026-3340
Amazon Linux 2 perl-Text-CSV_XS 1.00-3.amzn2.0.3 ALAS2-2026-4048

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 perl-Text-CSV_XS No fix yet —

Advisories 4

References