{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-110755", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-10-14T17:06:49.908Z", "datePublished": "2026-10-16T22:07:10.643Z", "dateUpdated": "2026-10-16T22:07:10.643Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Text::CSV_XS"], "packageName": "Text-CSV_XS", "packageURL": "pkg:cpan/Text-CSV_XS", "programFiles": ["CSV_XS.xs"], "programRoutines": [{"name": "Text::CSV_XS::getline"}], "repo": "https://github.com/cpan-authors/Text-CSV_XS", "versions": [{"lessThan": "1.65", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.\n\nA reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-407", "description": "CWE-407 Inefficient Algorithmic Complexity", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-16T22:07:10.643Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/cpan-authors/Text-CSV_XS/commit/f25e00aacd6fc15857b22487cb2e5ca263f377e0.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to Text-CSV_XS 1.65 or later."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-10-14T00:00:00.000Z", "value": "Fix committed to upstream repository."}, {"lang": "en", "time": "2026-10-15T00:00:00.000Z", "value": "Version 1.65 released with fix."}], "title": "Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Text::CSV_XS"], "packageName": "Text-CSV_XS", "packageURL": "pkg:cpan/Text-CSV_XS", "programFiles": ["CSV_XS.xs"], "programRoutines": [{"name": "Text::CSV_XS::getline"}], "repo": "https://github.com/cpan-authors/Text-CSV_XS", "versions": [{"lessThan": "1.65", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.\n\nA reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input."}], "id": "CVE-2026-110755", "lastModified": "2026-10-16T23:17:00.740", "metrics": {}, "published": "2026-10-16T23:17:00.740", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/cpan-authors/Text-CSV_XS/commit/f25e00aacd6fc15857b22487cb2e5ca263f377e0.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-407"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-text-csv_xs: Text::CSV_XS: Denial of Service via crafted carriage return line endings", "id": "2554503", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554503"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in Text::CSV_XS. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing specially crafted comma-separated value (CSV) input using carriage return (CR)-only line endings. Under default configuration settings, the parser repeatedly copies unparsed data across records, leading to excessive CPU consumption and application unresponsiveness."], "name": "CVE-2026-110755", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "perl-Text-CSV_XS", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "perl-Text-CSV_XS", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "perl-Text-CSV_XS", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-16T22:07:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-110755\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-110755\nhttps://github.com/cpan-authors/Text-CSV_XS/commit/f25e00aacd6fc15857b22487cb2e5ca263f377e0.patch\nhttps://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes"], "threat_severity": "Moderate"}

{"created": "2026-10-16T23:30:13.663688+00:00", "updated": "2026-10-17T02:15:14.839122+00:00", "vendors": []}