Bug 2554503 (CVE-2026-110755) - CVE-2026-110755 perl-text-csv_xs: Text::CSV_XS: Denial of Service via crafted carriage return line endings
Summary: CVE-2026-110755 perl-text-csv_xs: Text::CSV_XS: Denial of Service via crafted...
Keywords:
Status: NEW
Alias: CVE-2026-110755
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2555384 2555386
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-16 22:21 UTC by OSIDB Bzimport
Modified: 2026-10-19 05:34 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-16 22:21:47 UTC
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.

With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.

A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.


Note You need to log in before you can comment on or make changes to this bug.