Log in Start free

Vulnerability · Published Oct 16, 2026 · Assigned by CPANSec

CVE-2026-110758Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace

High 7.5

In plain English

A high-severity security flaw in Text-CSV_XS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 70.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace. Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there. Leading blanks are normally skipped before a field is stored, but an all-blank field still arrives after a leading escape_char that differs from quote_char, or as a quoted field in getline when its line ends in two CRs.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libtext-csv-xs-perlno fix listedDEBIAN-CVE-2026-110758
Debian:13libtext-csv-xs-perlno fix listedDEBIAN-CVE-2026-110758
Debian:14libtext-csv-xs-perl1.65-1DEBIAN-CVE-2026-110758
Ubuntu:22.04:LTSlibtext-csv-xs-perlno fix listedUBUNTU-CVE-2026-110758
Ubuntu:24.04:LTSlibtext-csv-xs-perlno fix listedUBUNTU-CVE-2026-110758
Ubuntu:26.04:LTSlibtext-csv-xs-perlno fix listedUBUNTU-CVE-2026-110758
Ubuntu:26.10libtext-csv-xs-perlno fix listedUBUNTU-CVE-2026-110758

Affected products (as reported)

VendorProductVersions
Text-CSV_XS 0 – before 1.65

Weakness: CWE-127 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References