CVE-2026-110755

Executive Summary

CVE-2026-110755 is a CPU-complexity vulnerability in the Perl module Text::CSV_XS affecting versions before 1.65. When eol is left at its default and input uses CR-only ("classic Mac") line endings, the vulnerable getline path copies the entire unparsed remainder of the input into a new buffer after parsing each record, producing quadratic (O(n²)) work growth. Any application, service, or batch pipeline that parses attacker-influenced CSV with default options is exposed to resource-exhaustion denial of service; parsing a single megabyte of CR-only CSV can consume seconds of CPU.

Technical Analysis

Text::CSV_XS is a widely used XS (C-level) parser for comma-separated values in the Perl ecosystem, and is commonly pulled in transitively by CSV-handling frameworks and data-ingestion utilities. The flaw is classified as CWE-407: Inefficient Algorithmic Complexity.

Root cause per the NVD description: when the eol option is unset (the default), getline reads input using Perl's default line separator (LF). Input whose records are terminated only by carriage return (CR, \r) is therefore not split into Perl lines and arrives as a single chunk. On each getline invocation the parser parses one record, then copies the still-unparsed remainder of the chunk into a new buffer. The next call parses from that buffer and copies its remainder again. Because the copied remainder shrinks only one record at a time, total copy volume is proportional to n + (n−r) + (n−2r) + …, i.e. quadratic in input size. On a bookended reader using defaults, roughly one megabyte of CR-only CSV yields seconds of CPU time.

Key characteristics:

• Trigger precondition: default eol handling combined with CR-only record separators. Well-formed LF- or CRLF-terminated CSV does not exhibit the pattern described.
• Attack surface: the network- or file-facing CSV ingestion boundary — upload endpoints, import features, API bodies parsed as CSV, log/message consumers, ETL jobs, mail or data attachments processed by Perl tooling.
• Amplification: the unbounded buffer-copy pattern means attacker-controlled payload size maps non-linearly to CPU cost, enabling very high amplification with small payloads.
• No memory-safety dimension is described: this is not a buffer overflow, injection, or memory corruption issue; integrity and confidentiality are not directly affected. Impact is availability-only (A:H per the derived vector above).
• Detail note: the supplied intelligence does not include specific internal function names beyond getline and the eol option, so no further implementation specifics are asserted here.

Exploitation Scenarios

No public PoC exists; the attack chain below is inferred strictly from the described vulnerability class and mechanism.

1. Reconnaissance / target identification. The attacker identifies a service or workflow that parses CSV with Perl Text::CSV_XS using default options. Signals include CSV upload/import endpoints, bulk-ingest APIs, scheduled ETL jobs consuming third-party files, and stream processors written in Perl or frameworks that embed Text::CSV_XS. Probing can be done with harmless, small CSV samples to confirm CSV acceptance and how responses/latency behave.

2. Triggering the flaw. The attacker submits CSV content whose record separators are CR only (\r) instead of LF or CRLF, delivered as a single body/chunk. With eol unset, the reader receives the whole payload as one buffered chunk and iterates record-by-record, re-copying the growing remainder each time. Non-linear CPU growth begins as soon as the payload is parsed.

3. Payload / execution method. No code execution or injection is involved. The "payload" is ordinary-looking CSV correctness boundary abuse: the attacker simply chooses classic Mac line endings and sizes the input to exhaust the CPU budget of the parsing worker. Graduated payload sizes (hundreds of KB to several MB) can be used to calibrate impact while staying within upload limits. Concurrency multiplies the effect: many parallel submissions of CR-only CSV keep worker processes saturated even for modest per-request cost.

4. Post-exploitation impact. Availability degradation: worker pools pinned, request queues building, latency spikes for legitimate users, and potential timeouts/cascading failures in dependent pipelines. Repeated submissions can sustain the condition. Because the payloads are well-formed-looking CSV, casual content filters may pass them. There is no described path to data disclosure or integrity tampering; the outcome is denial of service against CSV-processing capacity.

Impact Assessment

• Direct impact: CPU resource exhaustion on hosts parsing the crafted input; seconds of CPU per megabyte per request, multiplied by request volume and parser concurrency.
• CVSS subscores (from derived vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): Network attack vector, low complexity, no privileges, no user interaction, unchanged scope, no confidentiality impact, no integrity impact, high availability impact. Aggregate base score would be 7.5 (High) — confirm with the vendor/NVD scoring once published (NVD currently lists no score).
• Affected systems / blast radius: any Perl service or data pipeline using Text::CSV_XS < 1.65 with eol unset that accepts untrusted or semi-trusted CSV. Because the module is a dependency pulled in by higher-level tooling, organizations may be exposed without directly listing it.
• Business impact: service unavailability for CSV import/export features, ingestion backlog, SLA breaches, and operational cost from troubleshooting. No KEV listing, no EPSS score, and no current exploit code reduce present likelihood but do not reduce the availability consequence if exposed.

Detection Guidance

Sigma Rule

title: Suspicious CR-only CSV Upload to Perl CSV Parsing Endpoint
id: 5c2f7a10-4e1b-4f4e-9a58-1107a55c0e01
status: experimental
description: Detects uploads dominated by CR-only line endings to CSV ingestion endpoints, consistent with CVE-2026-110755 resource-exhaustion attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110755
author: valtersit threat intel
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/import'
      - '/upload'
      - '/csv'
      - '/api/'
  selection_cr_only:
    cs-body|re: '^[^\n]*\r[^\n]*$'
  selection_large:
    sc-bytes|gte: 262144
  condition: selection_path and selection_large and selection_cr_only
falsepositives:
  - Legitimate classic-Mac CSV imports
  - Binary uploads with incidental CR bytes
level: medium

YARA Rule

rule CVE_2026_110755_CR_only_CSV_DoS
{
    meta:
        description = "Flags CSV payloads using CR-only record separators that stress Text::CSV_XS getline (CVE-2026-110755)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110755"
        cve = "CVE-2026-110755"
        author = "valtersit threat intel"
        severity = "medium"
    strings:
        // Classic-Mac CSV: CR separators without LF
        $line = /[^\r\n,]+\r/
        $comma = ","
    condition:
        filesize > 256KB and
        #comma > 100 and
        #line > 100 and
        not ( $line contains "\n" )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110755 Text::CSV_XS CR-only CSV CPU exhaustion attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"|0D|"; fast_pattern; filesize:>262144; pcre:"/^[^\x0a]*\x0d[^\x0a]*$/R"; classtype:attempted-dos; sid:900110755; rev:1; metadata:cve CVE-2026-110755, attack_target Web_Server, created_at 2026_01_01;)

(Filesize and content-length matching should be validated against your sensor; a pcre-only variant on http.request_body using !a b CR/LF heuristics is recommended where filesize is unsupported.)

Elastic Detection

sequence by source.ip with maxspan=2m
  [file where event.action == "upload" and file.size > 262144 and file.name : "*.csv"]
  [network where process.name : "perl" and event.type == "connection"]
| `Security-Detections` : "High CPU on CSV parsing host"

Alternative single-window rule (recommended where EQL file events are unavailable):

process where event.type == "start" and process.name : "perl" and
  process.args : "*.csv" and host.cpu.usage > 90

(Adjust index and field mappings to your Elastic stack; no specific exploitation artifacts exist, so the rules target the CR-only CSV upload + parsing-CPU pattern.)

Splunk SPL Query

index=web OR index=sysmon
(sourcetype=access_combined OR source="Perl*")
| eval cr_only=if(match(_raw, "(?m)^[^\n]*\r[^\n]*$"),1,0)
| where (bytes >= 262144 AND cr_only=1) OR (process_name=perl.exe AND cpu_pct > 90)
| stats count, sum(bytes) as total_bytes, values(uri_path) as paths by src_ip, host
| where count >= 2
| sort - total_bytes

Wazuh OSSEC Rule

<group name="cve_2026_110755,csv_dos,">
  <rule id="110755" level="8">
    <decoded_as>json</decoded_as>
    <field name="http.method">^POST$</field>
    <field name="url.path">(?i)(import|upload|csv|api)</field>
    <field name="http.content_length">^\d{6,}$</field>
    <regex type="pcre2">^[^\n]*\r[^\n]*$</regex>
    <description>CVE-2026-110755: possible CR-only CSV upload targeting Perl Text::CSV_XS (CPU exhaustion)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
  <rule id="110756" level="10" frequency="5" timeframe="120">
    <if_matched_sid>110755</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-110755: repeated CR-only CSV upload from same source (sustained DoS attempt)</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Set the eol option explicitly (e.g. to "\r" where classic-Mac CSV must be supported, or a strict LF/CRLF expectation) so record splitting does not fall back to Perl's default line separator over a single chunk.
   • Enforce upload and content-length limits and per-request CPU/parse timeouts; cap CSV size before handing data to Text::CSV_XS.
   • Reject or normalize CR-only payloads at the ingress boundary (normalize \r to \r\n/\n or discard inputs dominated by lone CR).
   • Isolate CSV parsing workers (process limits, cgroups, max concurrency, dropping privileges) so parsing cost cannot starve other services.
   • Apply rate limiting on CSV ingestion endpoints and monitor CPU spikes correlated with CSV parsing.

2. Patch / upgrade steps

   • Track the Text::CSV_XS distribution on CPAN/MetaCPAN and upgrade to a fixed release once the maintainer publishes one that resolves the quadratic getline behavior; the NVD description identifies 1.65 as the version boundary, so validate that release before rollout.
   • Audit your dependency tree (including transitive dependencies of frameworks) for Text::CSV_XS versions below 1.65 and rebuild affected containers/hosts.
   • Verify the change in staging with both CR-only and standard-terminated CSV; confirm CPU scaling is linear.

3. Long-term hardening

   • Add algorithm-complexity and resource-consumption checks to CSV ingestion code (size caps, record-count caps, parse deadlines) rather than trusting parser efficiency.
   • Incorporate dependency scanning for Perl modules and pin/verify versions in deployment pipelines.
   • Add alerting on CPU consumption by parsing processes to detect resource-exhaustion behavior early.

References

• NVD — CVE-2026-110755: https://nvd.nist.gov/vuln/detail/CVE-2026-110755
• MITRE CWE-407 (Inefficient Algorithmic Complexity): https://cwe.mitre.org/data/definitions/407.html
• MITRE ATT&CK T1499 (Endpoint Denial of Service): https://attack.mitre.org/techniques/T1499/
• MetaCPAN — Text::CSV_XS distribution (versions and changelog): https://metacpan.org/dist/Text-CSV_XS
• FIRST EPSS: no score assigned for this CVE at time of writing (not scored by FIRST.org)
• CISA KEV: not listed
• Exploit-in-the-wild evidence: none identified in supplied intelligence; PoC/exploit code: None; no Nuclei template available.