H.Merijn Brand - Tux <linux@tux.freedom.nl> reports:
Text::CSV_XS versions before 1.65 have these vulnerabilities listed below.
- CVE-2026-110759: parse (): report trailing lone CR, do not store EOF as 0xFF
- CVE-2026-110758: Under allow_whitespace, do not strip beyond field start
- CVE-2026-110757: combine (): decide quoting from the bytes, not the NV flags
- CVE-2026-110756: Flush saved bytes in Combine ()
- CVE-2026-110755: Re-use AHEAD with \r instead of copying
- CVE-2026-110754: getline (): free the result array when the parse fails
- CVE-2026-110753: Do not free the bound column scalar in skip_empty_rows
- CVE-2026-110752: fragment (): do not size memory by the selector integers