CVE-2026-110758

Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace. Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there. Leading blanks are normally skipped before a field is stored, but an all-blank field still arrives after a leading escape_char that differs from quote_char, or as a quoted field in getline when its line ends in two CRs.

• CWE-127

• https://github.com/cpan-authors/Text-CSV_XS/commit/efed7ee21177c59a5b69e787f84154e1fcb0d095.patch
• https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes

Published

Oct 16, 2026

Last Modified

Oct 20, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-110752Text::CSV_XS versions before 1.65 for Perl allow memory exha…7.5
• CVE-2026-110753Text::CSV_XS versions from 1.46 before 1.65 for Perl have a …9.8
• CVE-2026-110754Text::CSV_XS versions before 1.65 for Perl leak the parsed f…6.5
• CVE-2026-110755Text::CSV_XS versions before 1.65 for Perl allow quadratic C…7.5
• CVE-2026-110756Text::CSV_XS versions before 1.65 for Perl drop the end of a…9.8
• CVE-2026-110757Text::CSV_XS versions before 1.65 for Perl allow record spli…9.8
• CVE-2026-110759Text::CSV_XS versions before 1.65 for Perl return a 0xFF byt…9.8
• CVE-2026-11076Type Confusion in CSS in Google Chrome prior to 149.0.7827.5…8.8
• CVE-2026-110761ILIAS before 9.24, 10.12, and 11.5 contains a PHP object inj…8.8
• CVE-2026-110762bbPress before 2.6.19 contains an information disclosure vul…3.7
• CVE-2026-110763lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an in…4.3
• CVE-2026-110764AstronRPA through 1.1.6 contains an insecure direct object r…5.3