CVE-2026-113811 Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search.
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-113811?
CVE-2026-113811 is a vulnerability, published on 21 Oct 2026.
Official description
Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search.
The failure shift is cached for each pair of trie state and text character in a field of the matcher object, and nothing clears it. A character not seen before at a given state adds an entry that lasts for the life of the matcher.
An attacker who can submit text with many distinct characters to a long-lived matcher can grow its memory with each search.
Weakness: CWE-770
Which versions are affected by CVE-2026-113811?
How do I fix CVE-2026-113811?
No fix has been published for CVE-2026-113811 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-113811 being exploited?
There is no known exploitation of CVE-2026-113811 in the wild and no public exploit code.
Sources
Also known as GHSA-9vcx-647w-pr3h.