Live › vulnerability › CVE-2026-113811
Go to dashboardAlgorithm::UrataniTakeda versions 0.1.5 before 0.1.7 keep a failure-shift cache in the matcher object that is never cleared. An attacker who submits text with many distinct characters to a long-lived matcher can make its memory grow with each search until it is exhausted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use Algorithm::UrataniTakeda in a long-running process, such as a daemon or web worker that keeps one matcher object and searches untrusted input through it. Short-lived scripts that create a matcher per run are much less exposed, and anyone not using the module can skip it.
No product ranges from the sources yet.
cpanm --info Algorithm::UrataniTakeda or perl -MAlgorithm::UrataniTakeda -e 'print $Algorithm::UrataniTakeda::VERSION' to read the installed versionAlgorithm::UrataniTakeda to see whether it is pinned below 0.1.70.1.7 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search.
The failure shift is cached for each pair of trie state and text character in a field of the matcher object, and nothing clears it. A character not seen before at a given state adds an entry that lasts for the life of the matcher.
An attacker who can submit text with many distinct characters to a long-lived matcher can grow its memory with each search.
This page as .md · .json · in your agent: get_signal("CVE-2026-113811")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.