Bug 2554503 (CVE-2026-110755)

Summary: CVE-2026-110755 perl-text-csv_xs: Text::CSV_XS: Denial of Service via crafted carriage return line endings
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Text::CSV_XS. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing specially crafted comma-separated value (CSV) input using carriage return (CR)-only line endings. Under default configuration settings, the parser repeatedly copies unparsed data across records, leading to excessive CPU consumption and application unresponsiveness.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2555384, 2555386    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-16 22:21:47 UTC 
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.

With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.

A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.