Text::CSV_XS EUVD-2026-103195

Exploitation requires the target application to parse attacker-controlled CSV via Text::CSV_XS getline() with the default eol (record separator) unset AND the input to use CR-only (classic Mac, \r) line endings, which causes the whole stream to arrive as a single chunk and triggers the per-record quadratic remainder copy. Limiting factors: input using LF or CRLF line endings is NOT affected (the patch's own tests confirm LF behaves normally); the application must expose getline() to untrusted/large CSV, and because cost scales with the square of input size, meaningful DoS requires the attacker to supply reasonably large input (seconds of CPU per megabyte, escalating with size). No authentication or user interaction is required by the library itself.

This is a genuine but modest-priority issue, best characterized as a high-CVSS, low-real-world-urgency denial-of-service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) is availability-only, consistent with CWE-407 (algorithmic/quadratic complexity): no confidentiality or integrity impact. Exploitation signals are weak - EPSS is 0.19% (8th percentile), there is no CISA KEV listing, and no public weaponized exploit has been identified, so this is no public exploit identified at time of analysis (note the upstream patch ships a regression test that demonstrates the quadratic condition, but that is not an attack tool). The signals are internally consistent rather than conflicting: a low EPSS and absent KEV align with a non-RCE resource-exhaustion bug in a library. One metadata conflict stands out: the input Tag 'Information Disclosure' directly contradicts the CVSS (C:N) and CWE-407 - this is a CPU-exhaustion DoS, not a disclosure flaw, so treat that tag as erroneous. The A:H rating is defensible because the quadratic scaling means larger inputs (tens to hundreds of MB) escalate from seconds to minutes/hours of CPU, but single-request impact on a small file is limited; prioritize only where untrusted CSV is parsed with default options.

An application that accepts user-supplied CSV (e.g. a file-upload or import endpoint) and parses it with Text::CSV_XS getline() using default options receives a file that uses classic Mac CR-only (\r) line endings. Because the default record separator leaves CR-only input as one chunk, the parser re-copies the entire unparsed remainder after every record, so a few megabytes of crafted input consume seconds-to-minutes of CPU and degrade or deny service. No public weaponized exploit exists, but the mechanism is fully disclosed and the patch includes a test reproducing the quadratic behavior.