CVE-2026-110759

A flaw was found in Text::CSV_XS. When parsing comma-separated values (CSV) input ending in a field separator followed by an unescaped carriage return (CR) character, the parser incorrectly records an end-of-file marker as input data, introducing an extraneous byte into the output field. An attacker who can supply crafted CSV input could exploit this issue to cause data corruption or application processing errors.

This vulnerability is evaluated as having a Moderate impact because it is limited to integrity and availability issues without exposing sensitive data or allowing code execution. In Red Hat Enterprise Linux, perl-Text-CSV_XS is a shared library rather than a listening network service, meaning exposure is restricted to scripts and applications that process externally supplied CSV files. A risk of data corruption or application errors only occurs when parsing specific inputs where the concluding field is empty and followed by an isolated carriage return.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.