CVE catalog

CVE-2026-110756

Text::CSV_XS versions before 1.65 for Perl drop the…

Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected. The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.

Severity: Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Oct 16, 2026, 10:07:37 PM UTC
Updated: Oct 16, 2026, 11:17:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.41% · Oct 27, 2026

Projects and upstream resources

[libtext-csv-xs-perl][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	libtext-csv-xs-perl	`1.65-1`	FixedDistribution-reported fixed boundary	[CVE-2026-110756]
Debianforky	libtext-csv-xs-perl	`1.65-1`	FixedDistribution-reported fixed boundary	[CVE-2026-110756]

Showing 2 fix observations. All 33 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	libtext-csv-xs-perl	Not reported	AffectedDistribution reports no fix	[CVE-2026-110756]
Debianbookworm	libtext-csv-xs-perl	`1.49-1+deb12u1`	Affected	[CVE-2026-110756]
Debianbookworm-security	libtext-csv-xs-perl	`1.49-1+deb12u1`	Affected	[CVE-2026-110756]
Debianforky	libtext-csv-xs-perl	`1.65-1`	FixedDistribution-reported fixed boundary	[CVE-2026-110756]
Debiansid	libtext-csv-xs-perl	`1.65-1`	FixedDistribution-reported fixed boundary	[CVE-2026-110756]
Debiantrixie	libtext-csv-xs-perl	Not reported	AffectedDistribution reports no fix	[CVE-2026-110756]
Debiantrixie	libtext-csv-xs-perl	`1.60-1+deb13u1`	Affected	[CVE-2026-110756]
Ubuntu16.04	libtext-csv-xs-perl	`1.19-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu16.04	libtext-csv-xs-perl	`1.20-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu16.04	libtext-csv-xs-perl	`1.20-1build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu16.04	libtext-csv-xs-perl	`1.21-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu18.04	libtext-csv-xs-perl	`1.26-1build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu18.04	libtext-csv-xs-perl	`1.34-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu20.04	libtext-csv-xs-perl	`1.39-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu20.04	libtext-csv-xs-perl	`1.39-1build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu20.04	libtext-csv-xs-perl	`1.40-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu20.04	libtext-csv-xs-perl	`1.41-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu22.04	libtext-csv-xs-perl	`1.45-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu22.04	libtext-csv-xs-perl	`1.46-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu22.04	libtext-csv-xs-perl	`1.47-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu22.04	libtext-csv-xs-perl	`1.47-1build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu24.04	libtext-csv-xs-perl	`1.51-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu24.04	libtext-csv-xs-perl	`1.52-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu24.04	libtext-csv-xs-perl	`1.53-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu24.04	libtext-csv-xs-perl	`1.53-1build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu24.04	libtext-csv-xs-perl	`1.53-1build2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu24.04	libtext-csv-xs-perl	`1.53-1build3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu26.04	libtext-csv-xs-perl	`1.60-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu26.04	libtext-csv-xs-perl	`1.61-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu26.10	libtext-csv-xs-perl	`1.61-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu26.10	libtext-csv-xs-perl	`1.62-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu26.10	libtext-csv-xs-perl	`1.64-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC
Ubuntu26.10	libtext-csv-xs-perl	`1.64-1build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-110756]Oct 28, 2026, 8:17:41 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "libtext-csv-xs-perl",
      "status": "fixed",
      "release": "sid",
      "version": "1.65-1"
    },
    {
      "name": "libtext-csv-xs-perl",
      "status": "fixed",
      "release": "forky",
      "version": "1.65-1"
    },
    {
      "name": "libtext-csv-xs-perl",
      "status": "vulnerable",
      "release": "trixie",
      "version": "1.60-1+deb13u1"
    },
    {
      "name": "libtext-csv-xs-perl",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "1.49-1+deb12u1"
    },
    {
      "name": "libtext-csv-xs-perl",
      "status": "vulnerable",
      "release": "bookworm-security",
      "version": "1.49-1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1151096,
      "name": "libtext-csv-xs-perl",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.65-1"
    },
    {
      "bug": 1151096,
      "name": "libtext-csv-xs-perl",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.65-1"
    },
    {
      "bug": 1151096,
      "name": "libtext-csv-xs-perl",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1151096,
      "name": "libtext-csv-xs-perl",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "libtext-csv-xs-perl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "1.19-1",
        "1.20-1",
        "1.20-1build1",
        "1.21-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-110756",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-110756",
      "provider_updated_at": "2026-10-28T20:17:41.667437332Z",
      "applicability_unknown": true
    },
    {
      "name": "libtext-csv-xs-perl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "1.26-1build1",
        "1.34-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-110756",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-110756",
      "provider_updated_at": "2026-10-28T20:17:41.667437332Z",
      "applicability_unknown": true
    },
    {
      "name": "libtext-csv-xs-perl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "1.39-1",
        "1.39-1build1",
        "1.40-1",
        "1.41-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-110756",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-110756",
      "provider_updated_at": "2026-10-28T20:17:41.667437332Z",
      "applicability_unknown": true
    },
    {
      "name": "libtext-csv-xs-perl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "1.45-1",
        "1.46-1",
        "1.47-1",
        "1.47-1build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-110756",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-110756",
      "provider_updated_at": "2026-10-28T20:17:41.667437332Z",
      "applicability_unknown": true
    },
    {
      "name": "libtext-csv-xs-perl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "1.51-1",
        "1.52-1",
        "1.53-1",
        "1.53-1build1",
        "1.53-1build2",
        "1.53-1build3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-110756",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-110756",
      "provider_updated_at": "2026-10-28T20:17:41.667437332Z",
      "applicability_unknown": true
    },
    {
      "name": "libtext-csv-xs-perl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "26.10",
      "versions": [
        "1.61-1",
        "1.62-1",
        "1.64-1",
        "1.64-1build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-110756",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-110756",
      "provider_updated_at": "2026-10-28T20:17:41.667437332Z",
      "applicability_unknown": true
    },
    {
      "name": "libtext-csv-xs-perl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "1.60-1",
        "1.61-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-110756",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-110756",
      "provider_updated_at": "2026-10-28T20:17:41.667437332Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1151096]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libtext-csv-xs-perl]Unknown
Details (4)
- 1.49-1+deb12u1 · amd64 · bookworm
  Unknown · Fixed: 1.65-1
  Version impact unknown
  nvd · libtext-csv-xs-perl · debian · bookworm; pypi · libtext-csv-xs-perl · debian · 12; pypi · libtext-csv-xs-perl · debian · 13; pypi · libtext-csv-xs-perl · debian · 14
- 1.49-1+deb12u1 · arm64 · bookworm
  Unknown · Fixed: 1.65-1
  Version impact unknown
  nvd · libtext-csv-xs-perl · debian · bookworm; pypi · libtext-csv-xs-perl · debian · 12; pypi · libtext-csv-xs-perl · debian · 13; pypi · libtext-csv-xs-perl · debian · 14
- 1.49-1+deb12u1 · amd64 · bookworm-security
  Unknown · Fixed: 1.65-1
  Version impact unknown
  nvd · libtext-csv-xs-perl · debian · bookworm; pypi · libtext-csv-xs-perl · debian · 12; pypi · libtext-csv-xs-perl · debian · 13; pypi · libtext-csv-xs-perl · debian · 14
- 1.49-1+deb12u1 · arm64 · bookworm-security
  Unknown · Fixed: 1.65-1
  Version impact unknown
  nvd · libtext-csv-xs-perl · debian · bookworm; pypi · libtext-csv-xs-perl · debian · 12; pypi · libtext-csv-xs-perl · debian · 13; pypi · libtext-csv-xs-perl · debian · 14

[Debian 13 (Trixie)]

[libtext-csv-xs-perl]Unknown
Details (2)
- 1.60-1+deb13u1 · amd64 · trixie
  Unknown · Fixed: 1.65-1
  Version impact unknown
  nvd · libtext-csv-xs-perl · debian · bookworm; pypi · libtext-csv-xs-perl · debian · 12; pypi · libtext-csv-xs-perl · debian · 13; pypi · libtext-csv-xs-perl · debian · 14
- 1.60-1+deb13u1 · arm64 · trixie
  Unknown · Fixed: 1.65-1
  Version impact unknown
  nvd · libtext-csv-xs-perl · debian · bookworm; pypi · libtext-csv-xs-perl · debian · 12; pypi · libtext-csv-xs-perl · debian · 13; pypi · libtext-csv-xs-perl · debian · 14

Observed: Oct 29, 2026, 8:30:55 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]