CVE-2026-110755 cpan-authors CVE debrief

Who should care

Defenders responsible for Perl applications using Text::CSV_XS should assess exposure and prioritize patching or upgrading to version 1.65 or later. This vulnerability can cause performance issues and potentially lead to denial-of-service attacks.

Why it matters

CVE-2026-110755 is a vulnerability in Text::CSV_XS that can cause performance issues and potentially lead to denial-of-service attacks. Defenders responsible for Perl applications using Text::CSV_XS should assess exposure and prioritize patching or upgrading to version 1.65 or later.

• Denial-of-service attacks due to quadratic CPU use
• Performance issues with large input sizes
• Potential for increased CPU usage and resource utilization

Technical summary

The vulnerability in Text::CSV_XS versions before 1.65 for Perl can cause quadratic CPU use when handling CR-only input in getline. This issue can be triggered when the eol option is unset, which is the default setting. The problem arises from the parser copying the whole unparsed remainder into a new buffer after each record, leading to increased work with the square of the input size. A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input. Defenders should be aware of the potential performance impact and consider upgrading to version 1.65 or later to mitigate this issue.

Defensive priority

Defenders should prioritize patching or upgrading to version 1.65 or later of Text::CSV_XS to prevent potential performance issues.

Recommended defensive actions

• Patch or upgrade to version 1.65 or later of Text::CSV_XS
• Monitor for potential performance issues with Text::CSV_XS
• Consider setting the eol option to a specific value to prevent CR-only input issues
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the getline function in Text::CSV_XS, which can lead to quadratic CPU use when handling CR-only input. This issue can be triggered when the eol option is unset, which is the default setting.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.