Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search
Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search. The failure shift is cached for each pair of trie state and text character in a field of the matcher object, and nothing clears it. A character not seen before at a given state adds an entry that lasts for the life of the matcher. An attacker who can submit text with many distinct characters to a long-lived matcher can grow its memory with each search.
CVE-2026-113811
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-113811
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/robrwo/perl-Algorithm-UrataniTakeda",
"modules": [
"Algorithm::UrataniTakeda"
],
"versions": [
{
"status": "affected",
"version": "0.1.5",
"lessThan": "0.1.7",
"versionType": "custom"
}
],
"packageURL": "pkg:cpan/Algorithm-UrataniTakeda",
"packageName": "Algorithm-UrataniTakeda",
"programFiles": [
"lib/Algorithm/UrataniTakeda.pm"
],
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "Algorithm::UrataniTakeda::search"
}
]
}
]- Related CVEs
- CVE-2026-113811
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #50034 · Revision 1
- Added to Heist Feed
- Publisher date