CVE-2026-110757 Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine

Text::CSVXS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric...

CVE-2026-110757

The Text::CSV_XS Perl library (versions before 1.65 ) contains a flaw where it fails to quote fields flagged as numeric during CSV record formatting. Because Perl allows leading/trailing whitespace in numeric flags, an attacker can supply input containing embedded newline characters (e.g., 12 ) t...

CVE-2026-110757 Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine

Text::CSVXS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric...

CVE-2026-110757

Text::CSVXS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric...

CVE-2026-110756 Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print

Text::CSVXS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character...

CVE-2026-110756

The Text::CSV_XS module for Perl (versions before 1.65 ) contains a flaw where it drops the end of a record and its line ending during printing. This occurs when a UTF-8 flagged field precedes invalid UTF-8 bytes; the module holds back trailing bytes during buffer flushes but fails to write them ...

CVE-2026-110756 Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print

Text::CSVXS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character...

CVE-2026-110756

Text::CSVXS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character...

CVE-2026-110755

The Text::CSV_XS Perl module (versions before 1.65 ) is vulnerable to quadratic CPU use (CWE-407) due to an inefficient algorithmic complexity in the getline function. When the eol option is unset, input featuring carriage return (CR )-only line endings is treated as a single chunk. The parser re...

CVE-2026-110755 Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline

Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the...

CVE-2026-110755

Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the...

CVE-2026-110755 Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline

Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the...

CVE-2026-110754 Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline

Text::CSVXS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never fre...

CVE-2026-110754

The Text::CSV_XS Perl module (versions before 1.65 ) contains a memory leak vulnerability in the getline function. When the function encounters a record with a syntax error, it fails to free the array or the fields parsed before the error occurs, returning undef instead. An attacker capable of pr...

CVE-2026-110754 Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline

Text::CSVXS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never fre...

CVE-2026-110754

Text::CSVXS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never fre...

CVE-2026-110753

The Text::CSV_XS Perl module, specifically versions from 1.46 before 1.65 , is vulnerable to a use-after-free condition. When using bind_columns, the parser writes fields into the caller's scalars without taking a reference. If skip_empty_rows skips an empty last line, the parser frees the curren...

CVE-2026-110753 Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline

Text::CSVXS versions from 1.46 before 1.65 for Perl have a use-after-free of bindcolumns variables when skipemptyrows skips an empty line in getline. With bindcolumns, the parser writes each field into the caller's own scalar without taking a reference to it. When skipemptyrows skips an empty las...

CVE-2026-110753 Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline

Text::CSVXS versions from 1.46 before 1.65 for Perl have a use-after-free of bindcolumns variables when skipemptyrows skips an empty line in getline. With bindcolumns, the parser writes each field into the caller's own scalar without taking a reference to it. When skipemptyrows skips an empty las...

CVE-2026-110753

Text::CSVXS versions from 1.46 before 1.65 for Perl have a use-after-free of bindcolumns variables when skipemptyrows skips an empty line in getline. With bindcolumns, the parser writes each field into the caller's own scalar without taking a reference to it. When skipemptyrows skips an empty las...