{"id":"CVE-2026-110755","aliases":["AZL-109751","DEBIAN-CVE-2026-110755","EUVD-2026-103195","GHSA-chcw-qm6q-pg64","MGASA-2026-0563","SUSE-SU-2026:5120-1","UBUNTU-CVE-2026-110755","openSUSE-SU-2026:12218-1"],"status":"published","title":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline","description":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.\n\nA reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00408,"percentile":0.35563,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-407"],"published":"2026-10-16T22:07:10Z","modified":"2026-11-06T12:30:03Z","fixes":[{"ecosystem":"Debian:14","package":"libtext-csv-xs-perl","fixed_in":["1.65-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.60-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.49-1","1.49-1+deb12u1","1.50-1","1.51-1","1.52-1","1.53-1","1.54-1","1.55-1","1.56-1","1.57-1","1.59-1","1.60-1","1.61-1","1.62-1","1.64-1","1.65-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60-1","1.60-1+deb13u1","1.61-1","1.62-1","1.64-1","1.65-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.65-1"}]}],"versions":["1.60-1","1.61-1","1.62-1","1.64-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.650.0-1.mga10"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19-1","1.20-1","1.20-1build1","1.21-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26-1build1","1.34-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.39-1","1.39-1build1","1.40-1","1.41-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.45-1","1.46-1","1.47-1","1.47-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.51-1","1.52-1","1.53-1","1.53-1build1","1.53-1build2","1.53-1build3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.61-1","1.62-1","1.64-1","1.64-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libtext-csv-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60-1","1.61-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Text-CSV_XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.650.0-1.1"}]}],"bundled":8}],"references":[{"url":"https://github.com/cpan-authors/Text-CSV_XS/commit/f25e00aacd6fc15857b22487cb2e5ca263f377e0.patch","tags":["patch","fix"]},{"url":"https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes","tags":["release-notes","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110755","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-chcw-qm6q-pg64"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110755.json","tags":["advisory"]},{"url":"https://github.com/cpan-authors/Text-CSV_XS","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-110755","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0563.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36532","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/16/38","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265120-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1286128","tags":["report"]},{"url":"https://bugzilla.suse.com/1286130","tags":["report"]},{"url":"https://bugzilla.suse.com/1286137","tags":["report"]},{"url":"https://bugzilla.suse.com/1286138","tags":["report"]},{"url":"https://bugzilla.suse.com/1286188","tags":["report"]},{"url":"https://bugzilla.suse.com/1286191","tags":["report"]},{"url":"https://bugzilla.suse.com/1286198","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110759","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-110755","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110755","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/44408689/","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110753","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-110755","title":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline","description":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.\n\nA reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.","status":"published","published":"2026-10-16T22:07:10.643Z","modified":"2026-10-20T18:25:20.728Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T13:34:26.24368Z"}],"euvd":[{"id":"EUVD-2026-103195","description":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.\n\nA reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.","status":"published","published":"2026-10-16T22:07:10Z","modified":"2026-10-20T18:25:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:43.145678Z"}],"ghsa":[{"id":"GHSA-chcw-qm6q-pg64","title":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed...","description":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.\n\nA reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.","status":"published","published":"2026-10-17T00:31:19Z","modified":"2026-10-20T21:30:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:14:04.750771Z"}],"nvd":[{"id":"CVE-2026-110755","description":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.\n\nA reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.","status":"published","published":"2026-10-16T23:17:00.74Z","modified":"2026-10-20T19:17:29.85Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:13:00.123071Z"}],"osv":[{"id":"CVE-2026-110755","title":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline","description":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.\n\nA reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.","status":"published","published":"2026-10-16T22:07:10.643Z","modified":"2026-11-06T12:41:58.826594383Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-06T13:13:28.189005Z"},{"id":"DEBIAN-CVE-2026-110755","description":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.  With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.  A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.","status":"published","published":"2026-10-16T23:17:00.74Z","modified":"2026-10-23T18:05:32.271812836Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:49.824149Z"},{"id":"UBUNTU-CVE-2026-110755","description":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size. A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.","status":"published","published":"2026-10-16T23:17:00Z","modified":"2026-10-28T20:17:41.464810268Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:59.591851Z"},{"id":"AZL-109751","title":"CVE-2026-110755 affecting package perl-Text-CSV_XS 1.60-1","description":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.\n\nA reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.","status":"published","published":"2026-10-16T23:17:00Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.42484Z"},{"id":"MGASA-2026-0563","title":"Updated perl-Text-CSV_XS package fixes security vulnerabilities","description":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by\nallocating one entry per index of an RFC 7111 selector in fragment.\n(CVE-2026-110752)\nText::CSV_XS versions from 1.46 before 1.65 for Perl have a\nuse-after-free of bind_columns variables when skip_empty_rows skips an\nempty line in getline. (CVE-2026-110753)\nText::CSV_XS versions before 1.65 for Perl leak the parsed fields of a\nrecord that fails to parse in getline. (CVE-2026-110754)\nText::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by\ncopying the unparsed remainder per record of CR-only input in getline.\n(CVE-2026-110755)\nText::CSV_XS versions before 1.65 for Perl drop the end of a record and\nits line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes\nin print. (CVE-2026-110756)\nText::CSV_XS versions before 1.65 for Perl allow record splitting by\nwriting strings used as numbers without quotes in combine.\n(CVE-2026-110757)\nText::CSV_XS versions before 1.65 for Perl read before the start of an\nall-blank field under allow_whitespace in strip_trail_whitespace.\n(CVE-2026-110758)\nText::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is\nnot in the input for an empty last field followed by a lone CR in parse.\n(CVE-2026-110759)\n","status":"published","published":"2026-10-28T02:10:00Z","modified":"2026-10-28T02:15:04.96411964Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12218-1","title":"perl-Text-CSV_XS-1.650.0-1.1 on GA media","description":"These are all security issues fixed in the perl-Text-CSV_XS-1.650.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-21T00:00:00Z","modified":"2026-10-22T17:23:11.300589166Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:5120-1","title":"Security update for perl-Text-CSV_XS","description":"This update for perl-Text-CSV_XS fixes the following issues:\n\n- CVE-2026-110752: unclamped RFC 7111 selector range pre-allocation in fragment() can cause memory exhaustion via large\n  index ranges (bsc#1286138).\n- CVE-2026-110754: unfreed field array memory leak on getline() syntax errors can lead to process memory exhaustion via\n  malformed CSV input (bsc#1286188).\n- CVE-2026-110755: quadratic buffer copying overhead during CR-only line parsing in getline() can cause CPU exhaustion\n  and denial of service (bsc#1286198).\n- CVE-2026-110756: invalid UTF-8 bytes during buffer flushes in print() can cause silent field truncation (bsc#1286130).\n- CVE-2026-110757: unquoted writing of numeric-flagged strings containing newlines in combine() and print() can cause\n  record splitting and row injection (bsc#1286191).\n- CVE-2026-110758: missing buffer start boundary check in strip_trail_whitespace under allow_whitespace can cause heap\n  out-of-bounds read and memory corruption (bsc#1286137).\n- CVE-2026-110759: improper end-of-file marker handling after a lone CR can cause Text::CSV_XS to inject an unexpected\n  0xFF byte (bsc#1286128).\n","status":"published","published":"2026-11-05T12:19:29Z","modified":"2026-11-06T12:30:03.490751417Z","updated_at":"2026-11-06T12:43:06.926783Z"}]}}