Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected. The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.
CVE-2026-110756
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-110756
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/cpan-authors/Text-CSV_XS",
"modules": [
"Text::CSV_XS"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.65",
"versionType": "custom"
}
],
"packageURL": "pkg:cpan/Text-CSV_XS",
"packageName": "Text-CSV_XS",
"programFiles": [
"CSV_XS.xs"
],
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "Text::CSV_XS::print"
}
]
}
]- Related CVEs
- CVE-2026-110756
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #42498 · Revision 1
- Added to Heist Feed
- Publisher date