CVE-2026-110755

A flaw was found in Text::CSV_XS. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing specially crafted comma-separated value (CSV) input using carriage return (CR)-only line endings. Under default configuration settings, the parser repeatedly copies unparsed data across records, leading to excessive CPU consumption and application unresponsiveness.

Red Hat has evaluated this vulnerability as having a Moderate impact because the flaw results in high CPU utilization and application unresponsiveness without permitting code execution or unauthorized data modification. The vulnerability is only exposed when Perl applications consume untrusted CSV documents using default parsing settings without an explicit line-break definition. Processing is confined to user space, limiting the blast radius to the specific process handling the malformed input.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.