CVE-2026-110759
Description
A flaw was found in Text::CSV_XS. When parsing comma-separated values (CSV) input ending in a field separator followed by an unescaped carriage return (CR) character, the parser incorrectly records an end-of-file marker as input data, introducing an extraneous byte into the output field. An attacker who can supply crafted CSV input could exploit this issue to cause data corruption or application processing errors.
Statement
This vulnerability is evaluated as having a Moderate impact because it is limited to integrity and availability issues without exposing sensitive data or allowing code execution. In Red Hat Enterprise Linux, perl-Text-CSV_XS is a shared library rather than a listening network service, meaning exposure is restricted to scripts and applications that process externally supplied CSV files. A risk of data corruption or application errors only occurs when parsing specific inputs where the concluding field is empty and followed by an isolated carriage return.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | Low | N/A | High |
| Availability Impact | Low | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
