{"id":"CVE-2026-113811","summary":"Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search","details":"Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search.\n\nThe failure shift is cached for each pair of trie state and text character in a field of the matcher object, and nothing clears it. A character not seen before at a given state adds an entry that lasts for the life of the matcher.\n\nAn attacker who can submit text with many distinct characters to a long-lived matcher can grow its memory with each search.","aliases":["GHSA-9vcx-647w-pr3h"],"modified":"2026-10-22T10:45:48.108387207Z","published":"2026-10-21T20:58:36.873Z","database_specific":{"cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113811.json","cna_assigner":"CPANSec"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/21/27"},{"type":"WEB","url":"https://cpan.org/modules"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113811.json"},{"type":"PACKAGE","url":"https://github.com/robrwo/perl-Algorithm-UrataniTakeda"},{"type":"FIX","url":"https://github.com/robrwo/perl-Algorithm-UrataniTakeda/commit/79897ef86a5a9bb6bc381718fe977c8150bc3d5b.patch"},{"type":"ADVISORY","url":"https://github.com/robrwo/perl-Algorithm-UrataniTakeda/security/advisories/GHSA-9vcx-647w-pr3h"},{"type":"ADVISORY","url":"https://metacpan.org/release/RRWO/Algorithm-UrataniTakeda-v0.1.7/changes"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113811"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/robrwo/perl-algorithm-uratanitakeda","events":[{"introduced":"8f144822873b52d751a5e806ffba5fbdd2e3354b"},{"fixed":"5b4741d70ba79d4decac2a04b57034fdf7f21480"},{"fixed":"79897ef86a5a9bb6bc381718fe977c8150bc3d5b"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0.1.5"},{"fixed":"0.1.7"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"fixed":"79897ef86a5a9bb6bc381718fe977c8150bc3d5b"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v0.1.6","v0.1.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113811.json"}}],"schema_version":"1.9.0"}