Data Handling Issue in Text::CSV_XS for Perl Affects Multiple Versions
CVE-2026-110756

Currently unrated

Key Information:

Status
Vendor
CVE Published:
16 October 2026

What is CVE-2026-110756?

The Text::CSV_XS module for Perl prior to version 1.65 is susceptible to a vulnerability that results in the loss of data during record processing. When handling records containing a UTF-8 flagged field followed by invalid UTF-8 bytes, the module fails to write the held-back bytes. As a result, the final part of such a record, including the closing quote and line ending, is dropped without any indication of failure from the print function. Consequently, this may cause subsequent records to be interpreted incorrectly, potentially compromising data integrity.

References

https://github.com/cpan-authors/Text-CSV_XS/commit/0610a8...
patch
https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/cha...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.