Quadratic CPU Usage Vulnerability in Text::CSV_XS by Perl

CVE-2026-110755

What is CVE-2026-110755?

The vulnerability in Text::CSV_XS affects Perl applications handling CSV files with CR-only line endings. When the end of line (eol) setting is at its default, the parser processes all input as a single chunk, leading to excessive resource consumption. Each record processed results in the unparsed remainder being duplicated in memory, thereby causing the time taken to parse to increase quadratically with the size of the input data. This can result in significant CPU usage for even moderately sized files, making such applications vulnerable to performance degradation.

References