CVE-2026-110758: Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace
Text::CSVXS versions before 1.65 for Perl read before the start of an all-blank field under allowwhitespace in striptrailwhitespace.
Under allowwhitespace, striptrailwhitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there.
Leading blanks are normally skipped before a field is stored, but an all-blank field still arrives after a leading escapechar that differs from quotechar, or as a quoted field in getline when its line ends in two CRs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Text::CSV_XSto a version that resolves this vulnerability.Fixed in 1.65
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using Text::CSV_XS versions before 1.65 are affected when allow_whitespace is enabled and processing reaches strip_trail_whitespace for an all-blank unquoted field or the specified getline quoted-field condition.
What input is needed to trigger the out-of-bounds read?
An all-blank field must reach trailing-whitespace stripping. This can occur after a leading escape_char that differs from quote_char, or for a quoted field processed by getline when the line ends with two CR characters.
What can be done before upgrading?
Avoid enabling allow_whitespace where possible, since the unsafe trailing-whitespace handling occurs under that option. Also avoid processing inputs that can produce the documented all-blank field cases until Text::CSV_XS is upgraded to 1.65 or later.