---
id: "CVE-2026-110756"
kind: "vulnerability"
aliases: ["CVE-2026-110756"]
title: "Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["csv-export", "package", "perl", "text-csv-xs"]
not_affected_if: ["uses-combine-not-print", "version-1.65-or-later"]
published_at: "2026-10-16T23:17:00+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-23T22:28:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110756", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field…

Text::CSV_XS for Perl before 1.65 can drop the last bytes of a record, including any closing quote and line ending, when print writes a UTF-8 flagged field followed by invalid UTF-8 bytes. The next record can then be merged onto the same line, or a missing closing quote can make a reader absorb all following records into one field.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION' (unknown whether other checks apply)
Look for code calling print (not combine) on CSV output that may contain UTF-8 flagged fields.

## Fix

Upgrade Text::CSV_XS to 1.65 or later.
If upgrading is not possible, use combine instead of print, which the sources say is not affected.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110756

## From the sources

Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.

When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected.

The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_