{"api_version":"1","generated_at":"2026-10-17T01:56:02+00:00","cve":"CVE-2026-110755","urls":{"html":"https://cve.report/CVE-2026-110755","api":"https://cve.report/api/cve/CVE-2026-110755.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-110755","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-110755"},"summary":{"title":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline","description":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.\n\nA reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.","state":"PUBLISHED","assigner":"CPANSec","published_at":"2026-10-16 23:17:00","updated_at":"2026-10-16 23:17:00"},"problem_types":["CWE-407","CWE-407 CWE-407 Inefficient Algorithmic Complexity"],"metrics":[],"references":[{"url":"https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes","name":"https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes","refsource":"9b29abf9-4ab0-4765-b253-1875cd9b441e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/cpan-authors/Text-CSV_XS/commit/f25e00aacd6fc15857b22487cb2e5ca263f377e0.patch","name":"https://github.com/cpan-authors/Text-CSV_XS/commit/f25e00aacd6fc15857b22487cb2e5ca263f377e0.patch","refsource":"9b29abf9-4ab0-4765-b253-1875cd9b441e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110755","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110755","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[{"source":"CNA","time":"2026-10-14T00:00:00.000Z","lang":"en","value":"Fix committed to upstream repository."},{"source":"CNA","time":"2026-10-15T00:00:00.000Z","lang":"en","value":"Version 1.65 released with fix."}],"solutions":[{"source":"CNA","title":"","value":"Upgrade to Text-CSV_XS 1.65 or later.","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["Text::CSV_XS"],"packageName":"Text-CSV_XS","packageURL":"pkg:cpan/Text-CSV_XS","programFiles":["CSV_XS.xs"],"programRoutines":[{"name":"Text::CSV_XS::getline"}],"repo":"https://github.com/cpan-authors/Text-CSV_XS","versions":[{"lessThan":"1.65","status":"affected","version":"0","versionType":"custom"}]}],"descriptions":[{"lang":"en","value":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.\n\nA reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-407","description":"CWE-407 Inefficient Algorithmic Complexity","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-16T22:07:10.643Z","orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","shortName":"CPANSec"},"references":[{"tags":["patch"],"url":"https://github.com/cpan-authors/Text-CSV_XS/commit/f25e00aacd6fc15857b22487cb2e5ca263f377e0.patch"},{"tags":["release-notes"],"url":"https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes"}],"solutions":[{"lang":"en","value":"Upgrade to Text-CSV_XS 1.65 or later."}],"source":{"discovery":"UNKNOWN"},"timeline":[{"lang":"en","time":"2026-10-14T00:00:00.000Z","value":"Fix committed to upstream repository."},{"lang":"en","time":"2026-10-15T00:00:00.000Z","value":"Version 1.65 released with fix."}],"title":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline","x_generator":{"engine":"cpansec-cna-tool 0.1"}}},"cveMetadata":{"assignerOrgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","assignerShortName":"CPANSec","cveId":"CVE-2026-110755","datePublished":"2026-10-16T22:07:10.643Z","dateReserved":"2026-10-14T17:06:49.908Z","dateUpdated":"2026-10-16T22:07:10.643Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-16 23:17:00","lastModifiedDate":"2026-10-16 23:17:00","problem_types":["CWE-407","CWE-407 CWE-407 Inefficient Algorithmic Complexity"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"110755","Ordinal":"1","Title":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU u","CVE":"CVE-2026-110755","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"110755","Ordinal":"1","NoteData":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.\n\nA reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.","Type":"Description","Title":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU u"}]}}}