CVE-2026-110755

Received Received - Intake

CPU Quota Exhaustion in Text::CSV_XS Perl Module

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: CPANSec

Description

Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size. A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-18

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-110755

EUVD

EUVD-2026-103195

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Text::CSV_XS Perl module before version 1.65. It causes high CPU usage when processing CSV files with CR-only line endings (classic Mac line endings). The parser inefficiently copies the unparsed part of the input repeatedly, leading to quadratic time complexity and slow performance on large files.

Detection Guidance

This vulnerability is specific to Text::CSV_XS Perl module versions before 1.65. To detect it, check the installed version of Text::CSV_XS on your system using the command: perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION'.

Impact Analysis

If you process CSV files with CR-only line endings using Text::CSV_XS before 1.65, your application may experience severe performance degradation. A megabyte of input could take seconds of CPU time, potentially causing delays or unresponsiveness in your system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a performance issue in a Perl CSV parsing library rather than a data security or privacy breach. However, prolonged processing delays could indirectly impact system availability, which may be relevant for compliance with availability requirements in some regulations.

Mitigation Strategies

Update Text::CSV_XS to version 1.65 or later to resolve the quadratic CPU usage issue in getline with CR-only line endings.

Hi! I’m here to help you understand CVE-2026-110755. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70