Text::CSV_XS before version 1.65 allows the parser to consume CPU resources in a quadratic fashion by copying the entire unparsed remainder of CR-only input for each record processed by getline. With classic Mac line endings, the input is read as a single chunk; each pass over a record copies the already‑processed remainder into a new buffer, leading to exponential growth in copy operations and CPU usage that scales with the square of the input size.

The vulnerability affects Text-CSV_XS modules for Perl releases prior to version 1.65. Systems that use these older modules to parse CSV data are impacted, particularly when feeding data with CR-only line endings.

No CVSS score or EPSS value is publicly available for this issue, and it is not listed in the CISA KEV catalog. However, the quadratic CPU consumption can lead to denial-of-service conditions if an attacker supplies a CSV file with classic Mac line endings to a vulnerable parser. This requires the ability to deliver or influence CSV input processed by the affected code, which can arise in web applications, data import scripts, or any code path that consumes CSV files from untrusted sources.