CVE-2026-113811
Description
AI Translation Available
Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search.
The failure shift is cached for each pair of trie state and text character in a field of the matcher object, and nothing clears it. A character not seen before at a given state adds an entry that lasts for the life of the matcher.
An attacker who can submit text with many distinct characters to a long-lived matcher can grow its memory with each search.
770
Allocation of Resources Without Limits or Throttling
IncompleteCommon Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Dos: Resource Consumption (Other)
Applicable Platforms
All platforms may be affected
https://github.com/robrwo/perl-Algorithm-UrataniTakeda/commit/79897ef86a5a9bb6b…
https://github.com/robrwo/perl-Algorithm-UrataniTakeda/security/advisories/GHSA…
https://metacpan.org/release/RRWO/Algorithm-UrataniTakeda-v0.1.7/changes