---
id: "CVE-2026-110755"
kind: "vulnerability"
aliases: ["CVE-2026-110755"]
title: "Text::CSV_XS: CR-only CSV input drives quadratic CPU use in getline"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["csv-import", "package", "perl", "self-hosted", "text-csv-xs"]
not_affected_if: ["eol-set-explicitly", "not-using-text-csv-xs", "trusted-input-only"]
published_at: "2026-10-16T23:17:00+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:24:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110755", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Text::CSV_XS: CR-only CSV input drives quadratic CPU use in getline

Text::CSV_XS before 1.65 for Perl copies the unparsed remainder of the input after every record when lines end in bare carriage returns, so parsing cost grows with the square of the input size. An attacker who can send a large CR-only CSV file to a reader using default options can tie up CPU for seconds per megabyte, which is a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION'`
- Find dependents with `cpanm --info Text::CSV_XS` or by searching `cpanfile` and `Makefile.PL` for Text::CSV_XS
- Check whether the application parses untrusted CSV uploads with the default eol setting

## Fix

- Upgrade Text::CSV_XS to `1.65` or later
- Until upgraded, set an explicit `eol` option or reject CR-only input before parsing (unknown whether this fully avoids the issue)

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110755

## From the sources

Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.

With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.

A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_