Live › vulnerability › CVE-2026-110756
Go to dashboardText::CSV_XS for Perl before 1.65 can drop the last bytes of a record, including any closing quote and line ending, when print writes a UTF-8 flagged field followed by invalid UTF-8 bytes. The next record can then be merged onto the same line, or a missing closing quote can make a reader absorb all following records into one field.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
perl -MText::CSV_XS -e print $Text::CSV_XS::VERSION (unknown whether other checks apply)
Look for code calling print (not combine) on CSV output that may contain UTF-8 flagged fields.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.
When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected.
The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.
This page as .md · .json · in your agent: get_signal("CVE-2026-110756")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.