CVE-2026-110755: Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline
Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.
With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.
A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Text::CSV_XSto a version that resolves this vulnerability.Fixed in 1.65
Event History
Frequently Asked Questions
Which deployments are most exposed to this CPU exhaustion issue?
Readers using getline with eol unset are exposed when they process CSV supplied with CR-only, classic Mac line endings. In that default configuration, Perl delivers the input as one chunk and repeated record handling causes work to grow quadratically with input size.
What does an attacker need to provide to trigger the excessive CPU use?
They need to cause the application to parse CSV containing CR-only line endings through getline with eol unset. Even a megabyte of such input can consume seconds of CPU time.
What can be changed if upgrading is not immediately possible?
Configure eol rather than leaving it unset when using getline, so processing does not rely on Perl's default line separator for CR-only input. Limiting the size of untrusted CSV input can also reduce the CPU impact, although the provided data does not identify a complete workaround other than avoiding the affected default behavior.
How can I determine whether my application is affected?
Check whether it uses Text::CSV_XS before version 1.65 and calls getline with eol unset. Then test or inspect whether untrusted input can contain CR-only line endings; that combination triggers the quadratic processing behavior.