Bug 2554504 (CVE-2026-110757)

Summary: CVE-2026-110757 perl-text-csv_xs: Text::CSV_XS: CSV record splitting via unquoted numeric fields
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Text::CSV_XS. An attacker can cause record splitting and data tampering by supplying input containing embedded newline characters that evaluates as numeric. Because the library fails to quote fields flagged as numeric when formatting Comma-Separated Values (CSV) records, the unquoted newline terminates the row prematurely and shifts subsequent fields into an unintended separate record.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2555383, 2555388    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-16 22:21:52 UTC 
Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine.

combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric operation when it parses as a number, which allows leading and trailing whitespace. With binary set, as csv does by default, "12\n" passes a check such as $qty > 0 and is then written unquoted with its newline.

A value validated as a number can end the record early and turn the fields after it into a separate row.