CVE-2026-110755Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline
Updated under an hour ago ()
Does this affect you?
It lists no affected products yet. Add what you run and Signals checks it as products are added.
EPSS puts the chance of exploitation in the next 30 days at 0.41%, higher than 35% of scored CVEs.
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size. A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.
- CVSS
- 7.5 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-407
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.41% (percentile 35)
- Assigned by
- CPANSec
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 20, 2026
- First seen by InfoSec Signals
- Oct 16, 2026
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.