========================================================================
CVE-2026-110758                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110758

  Distribution:  Text-CSV_XS
      Versions:  before 1.65
      MetaCPAN:  https://metacpan.org/dist/Text-CSV_XS
      VCS Repo:  https://github.com/cpan-authors/Text-CSV_XS

Text::CSV_XS versions before 1.65 for Perl read before the start of an
all-blank field under allow_whitespace in strip_trail_whitespace

Description
-----------
Text::CSV_XS versions before 1.65 for Perl read before the start of an
all-blank field under allow_whitespace in strip_trail_whitespace.

Under allow_whitespace, strip_trail_whitespace removes trailing spaces
and tabs from each unquoted field without stopping at the start of the
field. For a field of only blanks it reads the byte before the field's
heap buffer. If that byte is also a space or tab, it may be zeroed and
the walk continue backwards, depending on what the allocator placed
there.

Leading blanks are normally skipped before a field is stored, but an
all-blank field still arrives after a leading escape_char that differs
from quote_char, or as a quoted field in getline when its line ends in
two CRs.

Problem types
-------------
- CWE-127 Buffer Under-read

Solutions
---------
Upgrade to Text-CSV_XS 1.65 or later.

References
----------
https://github.com/cpan-authors/Text-CSV_XS/commit/efed7ee21177c59a5b69e787f84154e1fcb0d095.patch
https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes

Timeline
--------
- 2026-10-14: Fix committed to upstream repository.
- 2026-10-15: Version 1.65 released with fix.