{"id":"AZL-109760","summary":"CVE-2026-110759 affecting package perl-Text-CSV_XS 1.60-1","details":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.\n\nWhen the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse(\"a,\\r\") returns the fields \"a\" and \"\\xFF\". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.\n\nA CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.","modified":"2026-10-23T05:36:18Z","published":"2026-10-16T23:17:01Z","upstream":["CVE-2026-110759"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110759"}],"affected":[{"package":{"name":"perl-Text-CSV_XS","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/perl-Text-CSV_XS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.60-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109760.json"}}],"schema_version":"1.9.0"}