The vulnerability arises when a failure shift cache in the Algorithm::UrataniTakeda matcher is never cleared. Each time a new, unseen character is processed at a particular trie state, an entry is added that persists for the life of the matcher. This behavior can cause a memory‑exhaustion condition if an attacker repeatedly submits text containing many distinct characters. The result is a denial‑of‑service by exhausting available memory. This is a CWE-770 vulnerability, representing uncontrolled memory allocation.

Perl modules using Algorithm::UrataniTakeda version 0.1.5 and 0.1.6 are affected. The issue does not exist in 0.1.7 or later. The module is distributed via CPAN and maintained by the RRWO community.

The CVE notes that an attacker who can provide arbitrary input to a long‑lived matcher can trigger the memory growth, implying a remote or local attack vector depending on application exposure. This is a CWE-770 vulnerability, describing uncontrolled memory allocation. The CVSS score is 7.5, indicating high severity, while the EPSS score indicates a < 1% probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, but its memory‑exhaustion nature still poses a significant denial‑of‑service risk. Exploitation requires only the ability to submit input; there are no special privileges or code‑execution requirements.