{"id":"CVE-2026-110758","title":"perl-text-csv_xs: Text::CSV_XS: Denial of Service via out-of-bounds write during whitespace stripping (CVE-2026-110758)","summary":"A flaw was found in Text::CSV_XS. This vulnerability can lead to a Denial of Service (DoS) or memory corruption when processing specially crafted input. When whitespace stripping is enabled, parsing an unquoted field containing only blank …","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-124","CWE-127"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","affected":["enterprise_linux 10","enterprise_linux 7","enterprise_linux 9"],"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T23:06:28+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-110758.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-110758.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-110758"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554508"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110758"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110758"},{"url":"https://github.com/cpan-authors/Text-CSV_XS/commit/efed7ee21177c59a5b69e787f84154e1fcb0d095.patch"},{"url":"https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes"}],"tags":["csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-16T22:54:45.851Z","epss":0.00192,"epssPercentile":0.08264,"slug":"CVE-2026-110758","body":"## Overview\n\nA flaw was found in Text::CSV_XS. This vulnerability can lead to a Denial of Service (DoS) or memory corruption when processing specially crafted input. When whitespace stripping is enabled, parsing an unquoted field containing only blank spaces can cause the parser to read and overwrite memory located before the start of the allocated buffer. An attacker who supplies malicious input can exploit this behavior to crash the application or corrupt adjacent memory.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-110758.json)\n\n**perl-text-csv_xs: Text::CSV_XS: Denial of Service via out-of-bounds write during whitespace stripping** — rated Moderate by Red Hat. Released 2026-10-16.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 9\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 9\n\n## Remediation\n\nFix deferred","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":223705,"id":"CVE-2026-110758","ts":1792238372493,"field":"cvss","old":null,"new":"5.9"},{"seq":223704,"id":"CVE-2026-110758","ts":1792238372493,"field":"severity","old":"none","new":"medium"}]}