{"id":"CVE-2026-110756","kind":"vulnerability","aliases":["CVE-2026-110756"],"related":[],"title":"Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field…","description":"Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.\n\nWhen a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected.\n\nThe next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.","summary":"Text::CSV_XS for Perl before 1.65 can drop the last bytes of a record, including any closing quote and line ending, when print writes a UTF-8 flagged field followed by invalid UTF-8 bytes. The next record can then be merged onto the same line, or a missing closing quote can make a reader absorb all following records into one field.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["csv-export","package","perl","text-csv-xs"],"not_affected_if":["uses-combine-not-print","version-1.65-or-later"],"how_to_check":"perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION' (unknown whether other checks apply)\nLook for code calling print (not combine) on CSV output that may contain UTF-8 flagged fields.","fix":"Upgrade Text::CSV_XS to 1.65 or later.\nIf upgrading is not possible, use combine instead of print, which the sources say is not affected.","status":"open","published_at":"2026-10-16T23:17:00+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-23T22:04:57+00:00","updated_at":"2026-10-23T22:28:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:04:57Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Text::CSV_XS to 1.65 or later.\nIf upgrading is not possible, use combine instead of print, which the sources say is not affected.","reach":"unknown","impact":"medium","summary":"Text::CSV_XS for Perl before 1.65 can drop the last bytes of a record, including any closing quote and line ending, when print writes a UTF-8 flagged field followed by invalid UTF-8 bytes. The next record can then be merged onto the same line, or a missing closing quote can make a reader absorb all following records into one field.","category":"package","who_cares":["perl","text-csv-xs","csv-export"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Silent CSV record corruption and records merged into one field","analyst_note":"NVD scores this 9.8 critical, but the description describes data corruption, not code execution or data theft; confirm the score rationale at https://nvd.nist.gov/vuln/detail/CVE-2026-110756.","how_to_check":"perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION' (unknown whether other checks apply)\nLook for code calling print (not combine) on CSV output that may contain UTF-8 flagged fields.","needs_analyst":true,"not_affected_if":["version-1.65-or-later","uses-combine-not-print"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000832,"input_tokens":2896,"output_tokens":1084,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-110756':27A,30A '-2026':26A,29A '-8':22A,67B,74B,124C,130C,140C,153C '1.65':6A,46B,108C 'absorb':96B 'across':163C 'affect':209C 'back':145C,174C 'buffer':156C 'byte':51B,75B,131C,147C,175C,191C 'charact':161C 'close':57B,90B,195C,228C 'combin':206C 'complet':168C 'contain':137C 'csv':2A,32B,38B,41B,104C 'csv-export':31B 'cve':25A,28A 'drop':9A,48B,111C 'end':11A,18A,61B,113C,120C,187C,200C 'everi':234C 'export':33B 'field':24A,69B,102B,126C,142C,186C,223C,241C 'final':180C 'flag':23A,68B,125C,141C 'flush':157C,165C,181C 'follow':70B,98B,235C 'held':173C 'held-back':172C 'hold':144C 'includ':55B 'invalid':72B,128C 'last':50B,185C,222C 'line':17A,60B,86B,119C,199C,218C 'lose':192C 'make':93B,230C 'merg':82B 'miss':89B,227C 'next':77B,211C 'noth':169C 'one':101B 'onto':83B,215C 'packag':34B 'part':238C 'perl':8A,35B,44B,110C 'preced':127C 'print':63B,133C,143C,202C 'quot':58B,91B,196C,225C,229C 'reader':95B,232C 'record':14A,54B,78B,99B,116C,136C,178C,183C,212C,236C 'return':204C 'split':162C 'still':203C 'take':233C 'text':1A,37B,40B,103C 'text-csv-x':36B 'trail':146C 'true':205C 'two':164C 'utf':21A,66B,73B,123C,129C,139C,152C 'valid':151C 'version':4A,106C 'whose':184C 'write':64B,170C 'written':214C 'xs':3A,39B,42B,105C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T23:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110756","severity":null,"published_at":"2026-10-16T23:17:00+00:00","modified_at":"2026-10-20T19:17:30+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}