{"id":"CVE-2026-110759","kind":"vulnerability","aliases":["CVE-2026-110759"],"related":[],"title":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field…","description":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.\n\nWhen the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse(\"a,\\r\") returns the fields \"a\" and \"\\xFF\". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.\n\nA CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.","summary":"Text::CSV_XS before 1.65 for Perl inserts a stray 0xFF byte into the last field when input ends with a separator and a lone CR. The application receives a byte that was not in its input, and UTF-8 flagged input yields malformed UTF-8.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["csv-import","package","perl","text-csv-xs"],"not_affected_if":["no-csv-parsing-of-crlf-input","version-1.65-or-later"],"how_to_check":"Check the installed Text::CSV_XS version and confirm it is below 1.65.","fix":"Upgrade Text::CSV_XS to 1.65 or later.","status":"open","published_at":"2026-10-16T23:17:01+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-23T22:04:53+00:00","updated_at":"2026-10-23T22:28:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:04:53Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Text::CSV_XS to 1.65 or later.\nunknown","reach":"unknown","impact":"low","summary":"Text::CSV_XS before 1.65 for Perl inserts a stray 0xFF byte into the last field when input ends with a separator and a lone CR. The application receives a byte that was not in its input, and UTF-8 flagged input yields malformed UTF-8.","category":"package","who_cares":["perl","text-csv-xs","csv-import"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Parser injects stray 0xFF byte, corrupting parsed field data","analyst_note":"Sources conflict: NVD gives CVSS 9.8 but the description describes a data-corruption parser bug with no code execution or data disclosure; verify the CVSS vector at https://nvd.nist.gov/vuln/detail/CVE-2026-110759 and check the Text::CSV_XS release notes for the 1.65 fix.","how_to_check":"Check the installed Text::CSV_XS version and confirm it is below 1.65.\nunknown","needs_analyst":true,"not_affected_if":["version-1.65-or-later","no-csv-parsing-of-crlf-input"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000809,"input_tokens":2909,"output_tokens":1036,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-110759':26A,29A '-2026':25A,28A '-8':78B,84B,169C,178C,189C '0xff':11A,49B,95C,154C '1.65':6A,43B,90C 'applic':66B,225C 'binari':156C 'byte':12A,50B,69B,96C,153C,184C,228C 'charact':139C 'chomp':213C 'column':220C 'cr':64B,112C,127C 'crlf':206C 'csv':2A,31B,37B,40B,86C 'csv-import':30B 'cve':24A,27A 'empti':21A,105C,197C,222C 'end':57B,120C,132C,144C,214C 'end-of-fil':143C 'error':204C 'field':23A,54B,107C,150C,163C,174C,199C 'file':146C,207C 'flag':79B,170C,179C 'follow':108C 'hold':181C 'import':32B 'input':18A,56B,75B,80B,102C,117C,135C,171C,192C,234C 'insert':46B 'last':22A,53B,106C,173C,198C,219C 'line':209C,211C 'lone':63B,111C,126C,183C 'malform':82B,187C 'marker':147C 'next':138C 'non':196C 'non-empti':195C 'packag':33B 'pars':114C,119C,158C 'parser':129C 'perl':8A,34B,45B,92C 'r':160C 'read':208C 'receiv':67B,226C 'reject':201C 'return':9A,93C,161C 'separ':60B,123C 'set':157C 'store':141C 'stray':48B 'string':180C 'text':1A,36B,39B,85C 'text-csv-x':35B 'treat':130C 'utf':77B,83B,168C,177C,188C 'version':4A,88C 'way':216C 'xff':166C 'xs':3A,38B,41B,87C 'yield':81B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T23:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110759","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110759","severity":null,"published_at":"2026-10-16T23:17:01+00:00","modified_at":"2026-10-20T19:17:30+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}