Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search. The failure shift is cached for each pair of trie state and text character in a field of the matcher object, and nothing clears it. A character not seen before at a given state adds an entry that lasts for the life of the matcher. An attacker who can submit text with many distinct characters to a long-lived matcher can grow its memory with each search.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 6
- StatusReceived → DeferredNVD modified 2026-10-22 17:40
- References+1 references (now 4)NVD modified 2026-10-22 01:16
- StatusPublished → ReceivedNVD modified 2026-10-22 01:16
- StatusReceived → PublishedNVD modified 2026-10-21 20:58
- StatusPublished → ReceivedNVD modified 2026-10-21 21:17
- First seenunscoredNVD modified 2026-10-21 20:58
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 4
- https://github.com/robrwo/perl-Algorithm-UrataniTakeda/commit/79897ef86a5a9bb6bc381718fe977c8150bc3d5b.patch
- https://github.com/robrwo/perl-Algorithm-UrataniTakeda/security/advisories/GHSA-9vcx-647w-pr3h
- https://metacpan.org/release/RRWO/Algorithm-UrataniTakeda-v0.1.7/changes
- http://www.openwall.com/lists/oss-security/2026/10/21/27