{"id":"CVE-2026-110755","title":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline","summary":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl's default line separator, so input with CR…","severity":"none","cwe":["CWE-407"],"product":"Text-CSV_XS","affected":["Text-CSV_XS < 1.65"],"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T22:07:10.643Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110755","references":[{"url":"https://github.com/cpan-authors/Text-CSV_XS/commit/f25e00aacd6fc15857b22487cb2e5ca263f377e0.patch"},{"url":"https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes"}],"tags":["cve.org"],"ingestedAt":"2026-10-16T22:54:45.851Z","slug":"CVE-2026-110755","body":"## Overview\n\nText::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.\n\nA reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.\n\n## Affected\n\n- `Text-CSV_XS < 1.65`\n\n## Remediation\n\nUpgrade to Text-CSV_XS 1.65 or later.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}