CVE-2026-113811: CWE-770 Allocation of Resources Without Limits or Throttling

The vulnerability in Algorithm::UrataniTakeda (versions >=0.1.5 <0.1.7) arises from a failure shift cache that is stored per pair of trie state and text character in the matcher object and is never cleared. This leads to unbounded memory growth when processing input containing many distinct characters, as each new character-state pair adds a persistent cache entry. This is a classic case of CWE-770: Allocation of Resources Without Limits or Throttling, resulting in potential memory exhaustion.

An attacker who can supply input with many distinct characters to a long-lived matcher instance can cause the application to consume increasing amounts of memory, potentially leading to denial of service due to memory exhaustion. There is no indication of code execution or data corruption from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using vulnerable versions in contexts where untrusted input can be submitted to long-lived matcher objects, or implement application-level limits on input diversity or matcher lifetime to mitigate memory growth.