CVE-2026-110755: CWE-407 Inefficient Algorithmic Complexity
Description
Text::CSV_XS versions before 1.65 for Perl contain an inefficient algorithmic complexity vulnerability (CWE-407) that causes quadratic CPU usage when processing CSV input with carriage return (CR)-only line endings. This occurs because the getline function copies the entire unparsed remainder of the input buffer after each record, leading to performance degradation proportional to the square of the input size. This can cause significant CPU consumption when parsing large CSV files with classic Mac line endings.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Text::CSV_XS versions prior to 1.65 arises from the getline method's handling of input with CR-only line endings. When the end-of-line (eol) option is unset (default), getline reads the entire input chunk as one due to Perl's default line separator. After parsing each record, the parser copies the entire unparsed remainder into a new buffer for the next call, causing the CPU work to grow quadratically with input size. This inefficient algorithmic complexity can lead to excessive CPU usage when processing large CSV files with classic Mac line endings.
Potential Impact
The vulnerability results in excessive CPU consumption proportional to the square of the input size when processing CSV files with CR-only line endings. This can degrade performance significantly, causing delays or resource exhaustion on systems parsing such input. There is no indication of code execution or data corruption, only performance impact due to inefficient processing.
Mitigation Recommendations
No official patch or fix is currently documented. Users should avoid processing CSV input with CR-only line endings using affected versions or explicitly set the eol option to handle line endings properly if possible. Monitor vendor advisories for updates or patches addressing this inefficiency.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-10-14T17:06:49.908Z
- State
- PUBLISHED
Threat ID: 6ad2a6572cdf04f656423b13
Added to database: 10/16/2026, 22:33:59 UTC
Last enriched: 10/16/2026, 22:48:34 UTC
Last updated: 10/16/2026, 22:49:06 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.