Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Azure Perl Text-CSV_XS may add unexpected byte
published 19 days ago
Summary
The Perl Text-CSV_XS library used in Azure can insert a stray 0xFF byte when processing a line that ends with a separator and a single carriage‑return character. This hidden byte may corrupt data or cause errors in downstream processing. Upgrade to version 1.65 or later to prevent the extra byte from being added.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | perl-text-csv_xs | <= 1.60-1 |
Original advisory text
CVE-2026-110759 affecting package perl-Text-CSV_XS 1.60-1
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.
When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.
A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.
When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.
A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.
References
Timeline
Published16 Oct 2026
Updated21 Oct 2026
First seen21 Oct 2026
Sources
AZL-109760 · OSV
Track software like this
Free during beta