CPANSA-Algorithm-UrataniTakeda-2026-113811: Algorithm-UrataniTakeda vulnerability

Publisher giterlizzi Document category csaf_security_advisory
Initial release date 2026-10-21T00:00:00 Engine CSAF Perl Toolkit 0.26
Current release date 2026-10-21T00:00:00 Build Date
Current version 1 Status final
CVSS v3.1 Base Score Severity
Original language Language en
Also referred to

Vulnerability Description

Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search.

The failure shift is cached for each pair of trie state and text character in a field of the matcher object, and nothing clears it. A character not seen before at a given state adds an entry that lasts for the life of the matcher.

An attacker who can submit text with many distinct characters to a long-lived matcher can grow its memory with each search.

Vulnerabilities

CVE-2026-113811

Vulnerability Description

Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search.

The failure shift is cached for each pair of trie state and text character in a field of the matcher object, and nothing clears it. A character not seen before at a given state adds an entry that lasts for the life of the matcher.

An attacker who can submit text with many distinct characters to a long-lived matcher can grow its memory with each search.

Weakness CWE-770 : Allocation of Resources Without Limits or Throttling

Product status

Known affected
Product Score
Algorithm-UrataniTakeda greater than 0.1.5 and less than 0.1.7
CVSS Version CVSS Vector CVSS Base Score CVSS Base Severity
Fixed

giterlizzi

Namespace: https://github.com/giterlizzi/

gdt@cpan.org

References

Revision history

Version Date of the revision Summary of the revision
1 Wed Oct 21 00:00:00 2026 First release

Sharing rules

TLP:WHITE
For the TLP version see: https://www.first.org/tlp/