Perl Text::CSV_XS Vulnerability Affecting Leading Whitespace Handling
CVE-2026-110758

Currently unrated

Key Information:

Status
Vendor
CVE Published:
16 October 2026

What is CVE-2026-110758?

The Text::CSV_XS module for Perl has a vulnerability that impacts the handling of all-blank fields under specific conditions related to whitespace management. When configured with allow_whitespace, the function strip_trail_whitespace attempts to remove trailing spaces and tabs from unquoted fields. However, it does not terminate correctly at the beginning of all-blank fields. This behavior can lead to unintended memory access, potentially exposing the application to stability issues or further vulnerabilities. Developers are advised to update to version 1.65 or later to mitigate these risks.

References

https://github.com/cpan-authors/Text-CSV_XS/commit/efed7e...
patch
https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/cha...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.