Live › vulnerability › CVE-2026-110755
Go to dashboardText::CSV_XS before 1.65 for Perl copies the unparsed remainder of the input after every record when lines end in bare carriage returns, so parsing cost grows with the square of the input size. An attacker who can send a large CR-only CSV file to a reader using default options can tie up CPU for seconds per megabyte, which is a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that read CSV with Text::CSV_XS using the default options and accept input from users or other untrusted sources are exposed, because the default line separator lets CR-only files arrive as one large chunk. Batch jobs that only read trusted, locally produced CSV with normal line endings are unlikely to be affected. Teams that do not use Text::CSV_XS can skip it.
No product ranges from the sources yet.
perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION'cpanm --info Text::CSV_XS or by searching cpanfile and Makefile.PL for Text::CSV_XS1.65 or latereol option or reject CR-only input before parsing (unknown whether this fully avoids the issue)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.
With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.
A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.
This page as .md · .json · in your agent: get_signal("CVE-2026-110755")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.