ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-110759

Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse

Published Oct 16, 2026 · catalog updated Oct 16, 2026 · Red Hat Red Hat Enterprise Linux

Check if you run it

No confirmed exploitation is on record for CVE-2026-110759. EPSS is 0.19%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Gaps on this record

  • No version range is stored. A customer cannot check an installed version against this record.
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium6.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.19%
Remediation
Advisory link
Affected products
Red Hat Red Hat Enterprise Linux

Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error. A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.

No affected version ranges are stored yet. Use the vendor advisory before you decide this record does not apply.

How to fix CVE-2026-110759

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-110759. EPSS is 0.19%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-1286. EPSS 0.19%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 16, 2026 · Red Hat Security Data

    Detected

    perl-text-csv_xs: Text::CSV_XS: Data corruption via trailing carriage return in empty fields

  2. Oct 16, 2026 · CVE.org

    Updated

    Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF

Sources

  • CVE.orgVulnerability recordCVE-2026-110759

    Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the en

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-110759

    30-day exploitation probability 0.2%

    first.org
  • Red Hat Security DataVendor advisoryCVE-2026-110759

    perl-text-csv_xs: Text::CSV_XS: Data corruption via trailing carriage return in empty fields

    access.redhat.com

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.