{"id":"CVE-2026-110755","kind":"vulnerability","aliases":["CVE-2026-110755"],"related":[],"title":"Text::CSV_XS: CR-only CSV input drives quadratic CPU use in getline","description":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.\n\nA reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.","summary":"Text::CSV_XS before 1.65 for Perl copies the unparsed remainder of the input after every record when lines end in bare carriage returns, so parsing cost grows with the square of the input size. An attacker who can send a large CR-only CSV file to a reader using default options can tie up CPU for seconds per megabyte, which is a denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["csv-import","package","perl","self-hosted","text-csv-xs"],"not_affected_if":["eol-set-explicitly","not-using-text-csv-xs","trusted-input-only"],"how_to_check":"- Check the installed version with `perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION'`\n- Find dependents with `cpanm --info Text::CSV_XS` or by searching `cpanfile` and `Makefile.PL` for Text::CSV_XS\n- Check whether the application parses untrusted CSV uploads with the default eol setting","fix":"- Upgrade Text::CSV_XS to `1.65` or later\n- Until upgraded, set an explicit `eol` option or reject CR-only input before parsing (unknown whether this fully avoids the issue)","status":"open","published_at":"2026-10-16T23:17:00+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:24:52+00:00","updated_at":"2026-10-25T03:24:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:24:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Text::CSV_XS to `1.65` or later\n- Until upgraded, set an explicit `eol` option or reject CR-only input before parsing (unknown whether this fully avoids the issue)","reach":"unknown","title":"Text::CSV_XS: CR-only CSV input drives quadratic CPU use in getline","impact":"low","summary":"Text::CSV_XS before 1.65 for Perl copies the unparsed remainder of the input after every record when lines end in bare carriage returns, so parsing cost grows with the square of the input size. An attacker who can send a large CR-only CSV file to a reader using default options can tie up CPU for seconds per megabyte, which is a denial of service.","category":"package","nicknames":[],"who_cares":["perl","text-csv-xs","csv-import","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Parsing hangs and consumes CPU, causing denial of service","analyst_note":"","how_to_check":"- Check the installed version with `perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION'`\n- Find dependents with `cpanm --info Text::CSV_XS` or by searching `cpanfile` and `Makefile.PL` for Text::CSV_XS\n- Check whether the application parses untrusted CSV uploads with the default eol setting","needs_analyst":false,"not_affected_if":["not-using-text-csv-xs","trusted-input-only","eol-set-explicitly"],"who_is_affected":"Applications that read CSV with Text::CSV_XS using the default options and accept input from users or other untrusted sources are exposed, because the default line separator lets CR-only files arrive as one large chunk. Batch jobs that only read trusted, locally produced CSV with normal line endings are unlikely to be affected. Teams that do not use Text::CSV_XS can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000688,"input_tokens":3413,"output_tokens":694,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110755':17A,20A '-2026':16A,19A '1.65':37B,105C 'allow':108C 'arriv':147C 'attack':69B 'bare':54B 'buffer':164C 'call':168C 'carriag':55B 'chunk':150C 'classic':194C 'copi':40B,113C,156C,171C 'cost':59B 'cpu':11A,89B,110C,201C 'cr':5A,76B,121C,143C 'cr-on':4A,75B,120C,142C 'csv':2A,7A,22B,31B,34B,78B,101C,192C 'csv-import':21B 'cve':15A,18A 'default':84B,130C,136C,187C 'denial':97B 'drive':9A 'end':52B,146C,197C 'eol':127C 'everi':48B 'file':79B 'getlin':14A,125C,131C 'grow':60B,176C 'host':28B 'import':23B 'input':8A,46B,66B,123C,140C,182C,207C 'larg':74B 'line':51B,137C,145C,196C 'mac':195C 'megabyt':93B,205C 'new':163C 'next':167C 'one':149C 'option':85B,188C 'packag':24B 'pars':58B,169C 'parser':155C 'per':92B,117C 'perl':25B,39B,107C,134C 'quadrat':10A,109C 'read':132C 'reader':82B,185C 'record':49B,118C,153C 'remaind':43B,116C,160C 'return':56B 'second':91B,199C 'self':27B 'self-host':26B 'send':72B 'sent':191C 'separ':138C 'servic':99B 'size':67B,183C 'spend':198C 'squar':63B,179C 'text':1A,30B,33B,100C 'text-csv-x':29B 'tie':87B 'time':202C 'unpars':42B,115C,159C 'unset':128C 'use':12A,83B,111C 'version':103C 'whole':158C 'work':175C 'xs':3A,32B,35B,102C","nicknames":[],"mitigations":[],"who_affected":"Applications that read CSV with Text::CSV_XS using the default options and accept input from users or other untrusted sources are exposed, because the default line separator lets CR-only files arrive as one large chunk. Batch jobs that only read trusted, locally produced CSV with normal line endings are unlikely to be affected. Teams that do not use Text::CSV_XS can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T23:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110755","severity":null,"published_at":"2026-10-16T23:17:00+00:00","modified_at":"2026-10-20T19:17:29+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}