CVE-2026-110758

{
  "etk_id": "ETK-2026-2289",
  "cve_id": "CVE-2026-110758",
  "display_id": "CVE-2026-110758",
  "ghsa_id": "GHSA-fxm8-2g6q-9hhf",
  "euvd_id": "EUVD-2026-103198",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Out-of-bounds read in Text::CSV_XS whitespace handling",
  "summary": "Text::CSV_XS versions earlier than 1.65 can access memory before an all-blank CSV field while processing configured whitespace options. An attacker able to supply CSV input may trigger unintended reads and possible modification of adjacent whitespace bytes when both whitespace handling and trailing-whitespace stripping are enabled.",
  "mitigation": "Upgrade Text::CSV_XS to version 1.65 or later. Until upgraded, disable the combination of allow_whitespace and strip_trail_whitespace when processing untrusted CSV data.",
  "vendor": null,
  "product": "Text-CSV_XS",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.65"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.65"
      ],
      "package_name": "Text-CSV_XS",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 9.181465233333332,
  "t0_at": "2026-10-16T22:08:10.917000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-21T05:41:59.726202+00:00",
      "days": 4.315148254652778,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T22:08:10.917000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-16T22:08:10.917000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T22:08:10.917000+00:00",
      "url": "https://github.com/advisories/GHSA-fxm8-2g6q-9hhf"
    }
  }
}