CVE-2026-110755

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110755
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110755.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110755
Downstream
Published
2026-10-16T22:07:10Z
Modified
2026-10-21T02:54:59Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline
Details

Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.

With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.

A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.

Database specific 
{
    "cna_assigner":  "CPANSec",
    "cwe_ids":  [
        "CWE-407"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110755.json"
}
References

Affected packages

Git / github.com/cpan-authors/text-csv_xs

Affected ranges

Type
GIT
Repo
https://github.com/cpan-authors/text-csv_xs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
84085bcda35b916ff251e433cc5b7a1cf04066f5
Fixed
f25e00aacd6fc15857b22487cb2e5ca263f377e0
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.65"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "f25e00aacd6fc15857b22487cb2e5ca263f377e0"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*
0.33
0.34
0.35-Valloire
0.36
0.37
0.40
0.41
0.42
0.43
0.44
0.45
0.46
0.50
0.51
0.52
0.53
0.54
0.55
0.56
0.57
0.58
0.59
0.60
0.61
0.62
0.63
0.64
0.65
0.66
0.67
0.68
0.69
0.70
0.71
0.72
0.73
0.74
0.75
0.76
0.77
0.78
0.79
0.80
0.81
0.82
0.83
0.84
0.85
0.86
0.87
0.88
0.90
0.91
0.92
0.93
0.94
0.95
0.96
0.97
0.98
0.99
1.*
1.00
1.01
1.02
1.03
1.04
1.05
1.06
1.07
1.08
1.09
1.10
1.11
1.12
1.13
1.14
1.15
1.16
1.17
1.18
1.19
1.20
1.21
1.22
1.23
1.24
1.25
1.26
1.27
1.28
1.29
1.30
1.31
1.32
1.33
1.34
1.35
1.36
1.37
1.38
1.39
1.40
1.41
1.42
1.43
1.44
1.45
1.46
1.47
1.48
1.49
1.50
1.51
1.53
1.54
1.55
1.56
1.58
1.59
1.60
1.61
1.62
1.63
1.64

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110755.json"