{"id":"CVE-2026-110758","kind":"vulnerability","aliases":["CVE-2026-110758"],"related":[],"title":"Text::CSV_XS for Perl: out-of-bounds read on blank CSV fields","description":"Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace.\n\nUnder allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there.\n\nLeading blanks are normally skipped before a field is stored, but an all-blank field still arrives after a leading escape_char that differs from quote_char, or as a quoted field in getline when its line ends in two CRs.","summary":"Text::CSV_XS before 1.65 reads one byte before an all-blank unquoted field when allow_whitespace is enabled, and can zero bytes in memory the allocator placed there. The sources describe memory corruption and an out-of-bounds read; they do not describe code execution.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["csv-parsing","package","perl","text-csv-xs"],"not_affected_if":["allow-whitespace-off","trusted-input-only"],"how_to_check":"- Check the installed Text::CSV_XS version with `perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION'`\n- Search code and cpanfile/Makefile.PL for `allow_whitespace` and `strip_trail_whitespace` settings\n- unknown for whether specific inputs reach the affected path","fix":"- Upgrade Text::CSV_XS to `1.65` or later","status":"open","published_at":"2026-10-16T23:17:01+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:24:47+00:00","updated_at":"2026-10-25T03:24:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:24:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Text::CSV_XS to `1.65` or later","reach":"unknown","title":"Text::CSV_XS for Perl: out-of-bounds read on blank CSV fields","impact":"medium","summary":"Text::CSV_XS before 1.65 reads one byte before an all-blank unquoted field when allow_whitespace is enabled, and can zero bytes in memory the allocator placed there. The sources describe memory corruption and an out-of-bounds read; they do not describe code execution.","category":"package","nicknames":[],"who_cares":["perl","text-csv-xs","csv-parsing"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Out-of-bounds memory read and possible memory zeroing in the parser","analyst_note":"Confirm the affected version range and whether the NVD entry or the upstream Text::CSV_XS changelog names a fixed release beyond 1.65; check whether default settings reach the path.","how_to_check":"- Check the installed Text::CSV_XS version with `perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION'`\n- Search code and cpanfile/Makefile.PL for `allow_whitespace` and `strip_trail_whitespace` settings\n- unknown for whether specific inputs reach the affected path","needs_analyst":true,"not_affected_if":["allow-whitespace-off","trusted-input-only"],"who_is_affected":"Applications that parse CSV with Text::CSV_XS and set allow_whitespace, especially when they feed in untrusted files or lines with an escape_char that differs from quote_char, or getline input with lines ending in two CRs. Services that only parse trusted, fixed-format files are less exposed. The sources do not say whether default settings are affected.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000674,"input_tokens":3458,"output_tokens":656,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110758':17A,20A '-2026':16A,19A '1.65':34B,83C 'all-blank':40B,92C,179C 'alloc':57B,164C 'allow':46B,97C,104C 'also':146C 'arriv':184C 'backward':159C 'blank':12A,42B,94C,131C,168C,181C 'bound':9A,70B 'buffer':141C 'byte':37B,53B,135C,144C 'char':189C,194C 'code':76B 'continu':158C 'corrupt':64B 'crs':208C 'csv':2A,13A,22B,28B,31B,79C 'csv-pars':21B 'cve':15A,18A 'depend':160C 'describ':62B,75B 'differ':191C 'enabl':49B 'end':205C 'escap':188C 'execut':77B 'field':14A,44B,95C,117C,125C,128C,138C,174C,182C,199C 'getlin':201C 'heap':140C 'lead':167C,187C 'line':204C 'may':152C 'memori':55B,63B 'normal':170C 'one':36B 'out-of-bound':6A,67B 'packag':24B 'pars':23B 'perl':5A,25B,85C 'place':58B,165C 'quot':193C,198C 'read':10A,35B,71B,86C,133C 'remov':109C 'skip':171C 'sourc':61B 'space':111C,148C 'start':89C,122C 'still':183C 'stop':119C 'store':176C 'strip':100C,106C 'tab':113C,150C 'text':1A,27B,30B,78C 'text-csv-x':26B 'trail':101C,107C,110C 'two':207C 'unquot':43B,116C 'version':81C 'walk':157C 'whitespac':47B,98C,102C,105C,108C 'without':118C 'xs':3A,29B,32B,80C 'zero':52B,154C","nicknames":[],"mitigations":[],"who_affected":"Applications that parse CSV with Text::CSV_XS and set allow_whitespace, especially when they feed in untrusted files or lines with an escape_char that differs from quote_char, or getline input with lines ending in two CRs. Services that only parse trusted, fixed-format files are less exposed. The sources do not say whether default settings are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T23:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110758","severity":null,"published_at":"2026-10-16T23:17:01+00:00","modified_at":"2026-10-20T19:17:30+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}