CVE-2026-110752

Text::CSVXS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end colum...

CVE-2026-110756

Text::CSVXS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character...

CVE-2026-110755

Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the...

CVE-2026-110757

Text::CSVXS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric...

DEBIAN-CVE-2026-110757

Text::CSVXS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric...

CVE-2026-110759

A flaw was found in Text::CSVXS. When parsing comma-separated values CSV input ending in a field separator followed by an unescaped carriage return CR character, the parser incorrectly records an end-of-file marker as input data, introducing an extraneous byte into the output field. An attacker w...

CVE-2026-110758

A flaw was found in Text::CSVXS. This vulnerability can lead to a Denial of Service DoS or memory corruption when processing specially crafted input. When whitespace stripping is enabled, parsing an unquoted field containing only blank spaces can cause the parser to read and overwrite memory...

CVE-2026-110757

A flaw was found in Text::CSVXS. An attacker can cause record splitting and data tampering by supplying input containing embedded newline characters that evaluates as numeric. Because the library fails to quote fields flagged as numeric when formatting Comma-Separated Values CSV records, the...

CVE-2026-110756

A flaw was found in Text::CSVXS. When printing records where a UTF-8 flagged field precedes invalid UTF-8 bytes, the module drops held-back bytes, closing quotes, and line endings without signaling an error. An attacker capable of providing crafted input can exploit this flaw to cause data...

CVE-2026-110754

A flaw was found in Text::CSVXS. When parsing a CSV record containing a syntax error, the getline function fails to release memory allocated for fields parsed prior to the failure. An attacker who can supply malformed CSV input to a long-running application can exploit this vulnerability to trigg...

CVE-2026-110755

A flaw was found in Text::CSVXS. This vulnerability allows an attacker to cause a Denial of Service DoS by providing specially crafted comma-separated value CSV input using carriage return CR-only line endings. Under default configuration settings, the parser repeatedly copies unparsed data acros...

CVE-2026-110753

A flaw was found in perl-text-csvxs. This flaw allows an attacker who supplies specially crafted CSV input to trigger a Denial of Service DoS. When processing CSV data configured with bound column variables, the parser improperly releases memory references upon encountering empty rows. Subsequent...

CVE-2026-110752

A flaw was found in perl-Text-CSVXS. When parsing fragment selectors, the component pre-allocates array entries for every index in a requested range before reading data and without validating the range bounds against the input. An attacker could exploit this vulnerability by providing a crafted...

CVE-2026-110759 Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse

Text::CSVXS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker i...

CVE-2026-110759

Text::CSVXS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker i...

CVE-2026-110759 Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse

Text::CSVXS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker i...

CVE-2026-110759

The Text::CSV_XS Perl module in versions prior to 1.65 contains a flaw where parsing input ending in a separator followed by a lone carriage return (CR) causes the parser to incorrectly store an end-of-file marker as the byte 0xFF . This results in an extraneous byte being introduced into the out...

CVE-2026-110758 Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace

Text::CSVXS versions before 1.65 for Perl read before the start of an all-blank field under allowwhitespace in striptrailwhitespace. Under allowwhitespace, striptrailwhitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of onl...

CVE-2026-110758

The Text::CSV_XS Perl module (versions before 1.65 ) is vulnerable to a buffer under-read when parsing unquoted fields containing only blank spaces while allow_whitespace is enabled. The strip_trail_whitespace function fails to stop at the start of the field, potentially reading the byte before t...

CVE-2026-110758

Text::CSVXS versions before 1.65 for Perl read before the start of an all-blank field under allowwhitespace in striptrailwhitespace. Under allowwhitespace, striptrailwhitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of onl...