Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110755— Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline

Quick assessment

Affected
CVE-2026-110755
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 Text::CSV_XS 模块在 1.65 版本之前存在漏洞：当处理仅包含回车符（CR）作为行结束符的输入时， 方法会在每记录解析后复制未解析的剩余部分，导致 CPU 使用量呈二次方增长。 当 选项未设置（即使用默认值）时， 会采用 Perl 的默认行分隔符。因此，以 CR 作为行结束符的输入会被视为一个整体块。在解析完每条记录后，解析器会将整个未解析的剩余部分复制到新缓冲区中；下一次调用时，该缓冲区内容再次被解析并复制。这一过程导致总工作量随输入规模的平方而增长。 对于使用默认选项的读取器，若接收到

AI Predicted 5.9 Difficulty: Easy EPSS 0.19% · P8

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 1.65 affected

I. Basic Information for CVE-2026-110755

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline
Source: CVE Program / CVE List V5
Vulnerability Description
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size. A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 1.65 -

II. Public POCs for CVE-2026-110755

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110755

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110755 (1)

Other References for CVE-2026-110755 (1)

IV. Related Vulnerabilities

Same weakness: CWE-407

V. Comments for CVE-2026-110755

No comments yet

Leave a comment