{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "0.1.5"
                  },
                  {
                    "fixed": "0.1.7"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "fixed": "79897ef86a5a9bb6bc381718fe977c8150bc3d5b"
                  }
                ],
                "source": "REFERENCES_COMMIT"
              }
            ]
          },
          "events": [
            {
              "introduced": "8f144822873b52d751a5e806ffba5fbdd2e3354b"
            },
            {
              "fixed": "5b4741d70ba79d4decac2a04b57034fdf7f21480"
            },
            {
              "fixed": "79897ef86a5a9bb6bc381718fe977c8150bc3d5b"
            }
          ],
          "repo": "https://github.com/robrwo/perl-algorithm-uratanitakeda",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-9vcx-647w-pr3h"
  ],
  "database_specific": {
    "cna_assigner": "CPANSec",
    "cwe_ids": [
      "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113811.json"
  },
  "details": "Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search.\n\nThe failure shift is cached for each pair of trie state and text character in a field of the matcher object, and nothing clears it. A character not seen before at a given state adds an entry that lasts for the life of the matcher.\n\nAn attacker who can submit text with many distinct characters to a long-lived matcher can grow its memory with each search.",
  "id": "CVE-2026-113811",
  "modified": "2026-10-22T10:30:56.904522003Z",
  "published": "2026-10-21T20:58:36.873Z",
  "references": [
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/10/21/27"
    },
    {
      "type": "WEB",
      "url": "https://cpan.org/modules"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113811.json"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/robrwo/perl-Algorithm-UrataniTakeda"
    },
    {
      "type": "FIX",
      "url": "https://github.com/robrwo/perl-Algorithm-UrataniTakeda/commit/79897ef86a5a9bb6bc381718fe977c8150bc3d5b.patch"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/robrwo/perl-Algorithm-UrataniTakeda/security/advisories/GHSA-9vcx-647w-pr3h"
    },
    {
      "type": "ADVISORY",
      "url": "https://metacpan.org/release/RRWO/Algorithm-UrataniTakeda-v0.1.7/changes"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113811"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search"
}