Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110756— Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print

Quick assessment

Affected
CVE-2026-110756
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Perl 中，Text::CSV_XS 1.65 版本之前的实现存在一个漏洞：当在输出（print）过程中，某个被标记为 UTF-8 的字段后面紧跟无效的 UTF-8 字节时，记录的末尾及其行尾符会被丢弃。 具体机制如下：当记录中包含被标记为 UTF-8 的字段时，print 会在每次缓冲区刷新时暂存那些无法构成有效 UTF-8 的尾部字节，以便处理跨两次刷新被拆分的字符。然而，在记录最后一次刷新之后，这些被暂存的字节并未被写入。因此，若某记录的最后一个字段以此类字节结尾，则该字节、任何闭合引号以及行尾符均会丢

AI Predicted 7.5 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

I. Basic Information for CVE-2026-110756

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print
Source: CVE Program / CVE List V5
Vulnerability Description
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected. The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对输出编码和转义不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 1.65 -

II. Public POCs for CVE-2026-110756

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110756

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110756 (1)

Other References for CVE-2026-110756 (1)

IV. Related Vulnerabilities

Same weakness: CWE-116

V. Comments for CVE-2026-110756

No comments yet

Leave a comment