CVE-2026-113811 Details
Description
Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search. The failure shift is cached for each pair of trie state and text character in a field of the matcher object, and nothing clears it. A character not seen before at a given state adds an entry that lasts for the life of the matcher. An attacker who can submit text with many distinct characters to a long-lived matcher can grow its memory with each search.
A memory exhaustion vulnerability exists in Algorithm::UrataniTakeda versions 0.1.5 prior to 0.1.7 for Perl. The issue arises from a failure shift cache in the search function that is never cleared. This cache stores data for each combination of trie state and text character, leading to unbounded memory growth. An attacker can exploit this by sending text with many distinct characters to a long-lived matcher, causing the memory usage to increase with each search.
Users are advised to upgrade to Algorithm::UrataniTakeda version 0.1.7 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/robrwo/perl-Algorithm-UrataniTakeda/security/advisories/GHSA-9vcx-647w-pr3h | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/robrwo/perl-Algorithm-UrataniTakeda/commit/79897ef86a5a9bb6bc381718fe977c8150bc3d5b.patch | CPANSec | Source CodeVendor |
| https://github.com/robrwo/perl-Algorithm-UrataniTakeda/security/advisories/GHSA-9vcx-647w-pr3h | CPANSec | AdvisoryExploitRemedyVendor |
| https://metacpan.org/release/RRWO/Algorithm-UrataniTakeda-v0.1.7/changes | CPANSec | Release Notes |
| http://www.openwall.com/lists/oss-security/2026/10/21/27 | CVE | AdvisoryMailing ListRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Algorithm::UrataniTakeda | 0.1.5 (semver) 0.1.6 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | CVE Modified | CVE |
| Oct 21, 2026 | New CVE Received | CPANSec |