Live › vulnerability › CVE-2026-110758
Go to dashboardText::CSV_XS before 1.65 reads one byte before an all-blank unquoted field when allow_whitespace is enabled, and can zero bytes in memory the allocator placed there. The sources describe memory corruption and an out-of-bounds read; they do not describe code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that parse CSV with Text::CSV_XS and set allow_whitespace, especially when they feed in untrusted files or lines with an escape_char that differs from quote_char, or getline input with lines ending in two CRs. Services that only parse trusted, fixed-format files are less exposed. The sources do not say whether default settings are affected.
No product ranges from the sources yet.
perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION'allow_whitespace and strip_trail_whitespace settings1.65 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace.
Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there.
Leading blanks are normally skipped before a field is stored, but an all-blank field still arrives after a leading escape_char that differs from quote_char, or as a quoted field in getline when its line ends in two CRs.
This page as .md · .json · in your agent: get_signal("CVE-2026-110758")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.