Skip to content
OpenAdvisories
High · 7.5 CVE-2026-110755 EUVD-2026-103195GHSA-chcw-qm6q-pg64

Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline

Published Oct 16, 2026 · Updated Oct 20, 2026 · Assigned by CPANSec

Description

Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.

With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.

A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.

Affected products

VendorProductAffectedFixed
— Text-CSV_XS < 1.65 1.65

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libtext-csv-xs-perl 1.65-1 —
Debian 13 libtext-csv-xs-perl No fix yet —
Debian 12 libtext-csv-xs-perl No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 libtext-csv-xs-perl No fix yet —
Ubuntu 26.04 LTS libtext-csv-xs-perl No fix yet —
Ubuntu 24.04 LTS libtext-csv-xs-perl No fix yet —
Ubuntu 22.04 LTS libtext-csv-xs-perl No fix yet —
Ubuntu 20.04 LTS libtext-csv-xs-perl No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS libtext-csv-xs-perl No fix yet —
Ubuntu 16.04 LTS libtext-csv-xs-perl No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP7 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES 15 SP6 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES 15 SP5 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES 15 SP4 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES for SAP 15 SP5 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLES for SAP 15 SP4 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLE HPC 15 SP5 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
SLE HPC 15 SP4 perl-Text-CSV_XS 1.34-150000.3.6.1 SUSE-SU-2026:5120-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed perl-Text-CSV_XS 1.650.0-1.1 openSUSE-SU-2026:12218-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 perl-Text-CSV_XS 1.65-1.amzn2023.0.1 ALAS2023-2026-3340
Amazon Linux 2 perl-Text-CSV_XS 1.00-3.amzn2.0.3 ALAS2-2026-4048

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 perl-Text-CSV_XS No fix yet —

Advisories 4

References