CVE-2026-113811: Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search
Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search.
The failure shift is cached for each pair of trie state and text character in a field of the matcher object, and nothing clears it. A character not seen before at a given state adds an entry that lasts for the life of the matcher.
An attacker who can submit text with many distinct characters to a long-lived matcher can grow its memory with each search.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Algorithm::UrataniTakedato a version that resolves this vulnerability.Fixed in 0.1.7
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Long-lived matcher instances are exposed when they process attacker-controlled text containing many distinct characters. The cache retains an entry for each previously unseen trie-state and text-character pair for the lifetime of the matcher.
What must an attacker be able to do to trigger memory growth?
An attacker needs to submit text to a search performed by a long-lived matcher and include many distinct characters. Repeated searches can continue adding cache entries when new character and trie-state combinations are encountered.
Are affected releases limited to a particular version range?
Yes. The issue affects Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7.