Vulnerability-Lookup

CVE-2026-32686 (GCVE-0-2026-32686)

Vulnerability from cvelistv5 – Published: 2026-05-07 14:04 – Updated: 2026-09-08 13:08

Title

Unbounded exponent in decimal enables unauthenticated DoS

Summary

Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service. The decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new("1e1000000000")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM. Any application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash. This issue affects decimal: from 0.1.0 before 3.0.0.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-08 22:42 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

EEF CNA under the mitre root

CNA scorecard A 97/100 over 351 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/ericmj/decimal/security/adviso…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-32686.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-32686	related
https://github.com/ericmj/decimal/commit/bc11f4a2…	related
https://github.com/ericmj/decimal/commit/6a523f3a…	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
ericmj	decimal	Affected: 0.1.0 , < 3.0.0 (semver) cpe:2.3:a:ericmj:decimal::::::::
ericmj	decimal	Affected: bc11f4a2b6fb61fc1360a0ab4e79141bba918841 , < 6a523f3a73b8c9974540e21c7aa88f1258bb35ae (git) cpe:2.3:a:ericmj:decimal::::::::

Credits

Peter Ullrich Eric Meadows-Jönsson / Hex.pm José Valim Wojtek Mach Jonatan Männchen / EEF ruslandoga Matthew Johnston

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32686",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-08T22:42:13.343081Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-08T22:43:03.396Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Decimal\u0027"
          ],
          "packageName": "decimal",
          "packageURL": "pkg:hex/decimal",
          "product": "decimal",
          "programFiles": [
            "lib/decimal.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Decimal\u0027:new/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:parse/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:cast/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:add/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:sub/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:div/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:to_string/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:to_integer/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:round/3"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:compare/3"
            }
          ],
          "repo": "https://github.com/ericmj/decimal",
          "vendor": "ericmj",
          "versions": [
            {
              "lessThan": "3.0.0",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Decimal\u0027"
          ],
          "packageName": "ericmj/decimal",
          "packageURL": "pkg:github/ericmj/decimal",
          "product": "decimal",
          "programFiles": [
            "lib/decimal.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Decimal\u0027:new/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:parse/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:cast/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:add/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:sub/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:div/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:to_string/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:to_integer/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:round/3"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:compare/3"
            }
          ],
          "repo": "https://github.com/ericmj/decimal",
          "vendor": "ericmj",
          "versions": [
            {
              "lessThan": "6a523f3a73b8c9974540e21c7aa88f1258bb35ae",
              "status": "affected",
              "version": "bc11f4a2b6fb61fc1360a0ab4e79141bba918841",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.0.0",
                  "versionStartIncluding": "0.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Eric Meadows-J\u00f6nsson / Hex.pm"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Jos\u00e9 Valim"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Wojtek Mach"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "ruslandoga"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Matthew Johnston"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003edecimal\u003c/code\u003e library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. \u003ccode\u003eDecimal.new(\"1e1000000000\")\u003c/code\u003e) is accepted without error. Subsequent calls to arithmetic functions (\u003ccode\u003eDecimal.add/2\u003c/code\u003e, \u003ccode\u003eDecimal.sub/2\u003c/code\u003e, \u003ccode\u003eDecimal.div/2\u003c/code\u003eM), \u003ccode\u003eDecimal.to_string/2\u003c/code\u003eM with \u003ccode\u003e:normal\u003c/code\u003eM or \u003ccode\u003e:xsd\u003c/code\u003eM format, \u003ccode\u003eDecimal.to_integer/1\u003c/code\u003eM, \u003ccode\u003eDecimal.round/3\u003c/code\u003eM, or \u003ccode\u003eDecimal.compare/3\u003c/code\u003eM with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\u003c/p\u003e\n\u003cp\u003eAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\u003c/p\u003e\n\u003cp\u003eThis issue affects decimal: from 0.1.0 before 3.0.0.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe `decimal` library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. `Decimal.new(\"1e1000000000\")`) is accepted without error. Subsequent calls to arithmetic functions (`Decimal.add/2`, `Decimal.sub/2`, `Decimal.div/2`M), `Decimal.to_string/2`M with `:normal`M or `:xsd`M format, `Decimal.to_integer/1`M, `Decimal.round/3`M, or `Decimal.compare/3`M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0."
            }
          ],
          "value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new(\"1e1000000000\")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T13:08:41.575Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"
        },
        {
          "name": "EEF CNA record for CVE-2026-32686",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-32686.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-32686",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32686"
        },
        {
          "name": "Introducing commit bc11f4a in ericmj/decimal",
          "tags": [
            "related"
          ],
          "url": "https://github.com/ericmj/decimal/commit/bc11f4a2b6fb61fc1360a0ab4e79141bba918841"
        },
        {
          "name": "Fix commit 6a523f3 in ericmj/decimal",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unbounded exponent in decimal enables unauthenticated DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-32686",
    "datePublished": "2026-05-07T14:04:47.222Z",
    "dateReserved": "2026-03-13T09:12:14.474Z",
    "dateUpdated": "2026-09-08T13:08:41.575Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-32686",
      "date": "2026-11-07",
      "epss": "0.00484",
      "percentile": "0.4198"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.hex.pm",
                "cpes": [
                  "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.Decimal\u0027"
                ],
                "packageName": "decimal",
                "packageURL": "pkg:hex/decimal",
                "product": "decimal",
                "programFiles": [
                  "lib/decimal.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.Decimal\u0027:new/1"
                  },
                  {
                    "name": "\u0027Elixir.Decimal\u0027:parse/1"
                  },
                  {
                    "name": "\u0027Elixir.Decimal\u0027:cast/1"
                  },
                  {
                    "name": "\u0027Elixir.Decimal\u0027:add/2"
                  },
                  {
                    "name": "\u0027Elixir.Decimal\u0027:sub/2"
                  },
                  {
                    "name": "\u0027Elixir.Decimal\u0027:div/2"
                  },
                  {
                    "name": "\u0027Elixir.Decimal\u0027:to_string/2"
                  },
                  {
                    "name": "\u0027Elixir.Decimal\u0027:to_integer/1"
                  },
                  {
                    "name": "\u0027Elixir.Decimal\u0027:round/3"
                  },
                  {
                    "name": "\u0027Elixir.Decimal\u0027:compare/3"
                  }
                ],
                "repo": "https://github.com/ericmj/decimal",
                "vendor": "ericmj",
                "versions": [
                  {
                    "lessThan": "3.0.0",
                    "status": "affected",
                    "version": "0.1.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://github.com",
                "cpes": [
                  "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.Decimal\u0027"
                ],
                "packageName": "ericmj/decimal",
                "packageURL": "pkg:github/ericmj/decimal",
                "product": "decimal",
                "programFiles": [
                  "lib/decimal.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.Decimal\u0027:new/1"
                  },
                  {
                    "name": "\u0027Elixir.Decimal\u0027:parse/1"
                  },
                  {
                    "name": "\u0027Elixir.Decimal\u0027:cast/1"
                  },
                  {
                    "name": "\u0027Elixir.Decimal\u0027:add/2"
                  },
                  {
                    "name": "\u0027Elixir.Decimal\u0027:sub/2"
                  },
                  {
                    "name": "\u0027Elixir.Decimal\u0027:div/2"
                  },
                  {
                    "name": "\u0027Elixir.Decimal\u0027:to_string/2"
                  },
                  {
                    "name": "\u0027Elixir.Decimal\u0027:to_integer/1"
                  },
                  {
                    "name": "\u0027Elixir.Decimal\u0027:round/3"
                  },
                  {
                    "name": "\u0027Elixir.Decimal\u0027:compare/3"
                  }
                ],
                "repo": "https://github.com/ericmj/decimal",
                "vendor": "ericmj",
                "versions": [
                  {
                    "lessThan": "6a523f3a73b8c9974540e21c7aa88f1258bb35ae",
                    "status": "affected",
                    "version": "bc11f4a2b6fb61fc1360a0ab4e79141bba918841",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new(\"1e1000000000\")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0."
          },
          {
            "lang": "es",
            "value": "La vulnerabilidad de consumo de recursos no controlado en ericmj decimal permite la denegaci\u00f3n de servicio remota no autenticada.\n\nLa biblioteca decimal no limita el exponente en la entrada analizada. Almacenar un decimal con un exponente muy grande (p. ej., Decimal.new(\u20191e1000000000\u2019)) es aceptado sin error. Las llamadas subsiguientes a funciones aritm\u00e9ticas (Decimal.add/2, Decimal.sub/2, Decimal.div/2), Decimal.to_string/2 con formato :normal o :xsd, Decimal.to_integer/1, Decimal.round/3, o Decimal.compare/3 con un umbral asignan memoria proporcional al valor del exponente, lo que puede agotar la memoria disponible y bloquear la VM de BEAM.\n\nCualquier aplicaci\u00f3n que acepte entrada decimal proporcionada por el usuario y posteriormente realice operaciones aritm\u00e9ticas, redondeo, conversi\u00f3n a entero o formato de cadena en ella est\u00e1 expuesta. Una \u00fanica solicitud maliciosa es suficiente para causar un bloqueo por falta de memoria.\n\nEste problema afecta a decimal: desde 0.1.0 antes de 3.0.0."
          }
        ],
        "id": "CVE-2026-32686",
        "lastModified": "2026-10-26T20:10:00.160",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-32686",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-08T22:42:13.343081Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-07T15:16:05.370",
        "references": [
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://cna.erlef.org/cves/CVE-2026-32686.html"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/ericmj/decimal/commit/bc11f4a2b6fb61fc1360a0ab4e79141bba918841"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32686"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"
          }
        ],
        "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-05-27T02:12:37+00:00",
      "cve": "CVE-2026-32686",
      "id": "CVE-2026-32686",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Unbounded exponent in decimal enables unauthenticated DoS",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32686.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-32686",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-08T22:42:13.343081Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-08T22:42:55.384Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.hex.pm",
              "cpes": [
                "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.Decimal\u0027"
              ],
              "packageName": "decimal",
              "packageURL": "pkg:hex/decimal",
              "product": "decimal",
              "programFiles": [
                "lib/decimal.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.Decimal\u0027:new/1"
                },
                {
                  "name": "\u0027Elixir.Decimal\u0027:parse/1"
                },
                {
                  "name": "\u0027Elixir.Decimal\u0027:cast/1"
                },
                {
                  "name": "\u0027Elixir.Decimal\u0027:add/2"
                },
                {
                  "name": "\u0027Elixir.Decimal\u0027:sub/2"
                },
                {
                  "name": "\u0027Elixir.Decimal\u0027:div/2"
                },
                {
                  "name": "\u0027Elixir.Decimal\u0027:to_string/2"
                },
                {
                  "name": "\u0027Elixir.Decimal\u0027:to_integer/1"
                },
                {
                  "name": "\u0027Elixir.Decimal\u0027:round/3"
                },
                {
                  "name": "\u0027Elixir.Decimal\u0027:compare/3"
                }
              ],
              "repo": "https://github.com/ericmj/decimal",
              "vendor": "ericmj",
              "versions": [
                {
                  "lessThan": "3.0.0",
                  "status": "affected",
                  "version": "0.1.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://github.com",
              "cpes": [
                "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.Decimal\u0027"
              ],
              "packageName": "ericmj/decimal",
              "packageURL": "pkg:github/ericmj/decimal",
              "product": "decimal",
              "programFiles": [
                "lib/decimal.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.Decimal\u0027:new/1"
                },
                {
                  "name": "\u0027Elixir.Decimal\u0027:parse/1"
                },
                {
                  "name": "\u0027Elixir.Decimal\u0027:cast/1"
                },
                {
                  "name": "\u0027Elixir.Decimal\u0027:add/2"
                },
                {
                  "name": "\u0027Elixir.Decimal\u0027:sub/2"
                },
                {
                  "name": "\u0027Elixir.Decimal\u0027:div/2"
                },
                {
                  "name": "\u0027Elixir.Decimal\u0027:to_string/2"
                },
                {
                  "name": "\u0027Elixir.Decimal\u0027:to_integer/1"
                },
                {
                  "name": "\u0027Elixir.Decimal\u0027:round/3"
                },
                {
                  "name": "\u0027Elixir.Decimal\u0027:compare/3"
                }
              ],
              "repo": "https://github.com/ericmj/decimal",
              "vendor": "ericmj",
              "versions": [
                {
                  "lessThan": "6a523f3a73b8c9974540e21c7aa88f1258bb35ae",
                  "status": "affected",
                  "version": "bc11f4a2b6fb61fc1360a0ab4e79141bba918841",
                  "versionType": "git"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "3.0.0",
                      "versionStartIncluding": "0.1.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "AND"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Peter Ullrich"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Eric Meadows-J\u00f6nsson / Hex.pm"
            },
            {
              "lang": "en",
              "type": "remediation reviewer",
              "value": "Jos\u00e9 Valim"
            },
            {
              "lang": "en",
              "type": "remediation reviewer",
              "value": "Wojtek Mach"
            },
            {
              "lang": "en",
              "type": "analyst",
              "value": "Jonatan M\u00e4nnchen / EEF"
            },
            {
              "lang": "en",
              "type": "remediation reviewer",
              "value": "ruslandoga"
            },
            {
              "lang": "en",
              "type": "remediation reviewer",
              "value": "Matthew Johnston"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eUncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003edecimal\u003c/code\u003e library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. \u003ccode\u003eDecimal.new(\"1e1000000000\")\u003c/code\u003e) is accepted without error. Subsequent calls to arithmetic functions (\u003ccode\u003eDecimal.add/2\u003c/code\u003e, \u003ccode\u003eDecimal.sub/2\u003c/code\u003e, \u003ccode\u003eDecimal.div/2\u003c/code\u003eM), \u003ccode\u003eDecimal.to_string/2\u003c/code\u003eM with \u003ccode\u003e:normal\u003c/code\u003eM or \u003ccode\u003e:xsd\u003c/code\u003eM format, \u003ccode\u003eDecimal.to_integer/1\u003c/code\u003eM, \u003ccode\u003eDecimal.round/3\u003c/code\u003eM, or \u003ccode\u003eDecimal.compare/3\u003c/code\u003eM with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\u003c/p\u003e\n\u003cp\u003eAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\u003c/p\u003e\n\u003cp\u003eThis issue affects decimal: from 0.1.0 before 3.0.0.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe `decimal` library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. `Decimal.new(\"1e1000000000\")`) is accepted without error. Subsequent calls to arithmetic functions (`Decimal.add/2`, `Decimal.sub/2`, `Decimal.div/2`M), `Decimal.to_string/2`M with `:normal`M or `:xsd`M format, `Decimal.to_integer/1`M, `Decimal.round/3`M, or `Decimal.compare/3`M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0."
                }
              ],
              "value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new(\"1e1000000000\")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-130",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-130 Excessive Allocation"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-400",
                  "description": "CWE-400 Uncontrolled Resource Consumption",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-08T13:08:41.575Z",
            "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "shortName": "EEF"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory",
                "related"
              ],
              "url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"
            },
            {
              "name": "EEF CNA record for CVE-2026-32686",
              "tags": [
                "related"
              ],
              "url": "https://cna.erlef.org/cves/CVE-2026-32686.html"
            },
            {
              "name": "OSV record EEF-CVE-2026-32686",
              "tags": [
                "related"
              ],
              "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32686"
            },
            {
              "name": "Introducing commit bc11f4a in ericmj/decimal",
              "tags": [
                "related"
              ],
              "url": "https://github.com/ericmj/decimal/commit/bc11f4a2b6fb61fc1360a0ab4e79141bba918841"
            },
            {
              "name": "Fix commit 6a523f3 in ericmj/decimal",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Unbounded exponent in decimal enables unauthenticated DoS"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "assignerShortName": "EEF",
        "cveId": "CVE-2026-32686",
        "datePublished": "2026-05-07T14:04:47.222Z",
        "dateReserved": "2026-03-13T09:12:14.474Z",
        "dateUpdated": "2026-09-08T13:08:41.575Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-32686

Vulnerability from fkie_nvd - Published: 2026-05-07 15:16 - Updated: 2026-10-26 20:10

Severity

6.9 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-32686.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ericmj/decimal/commit/bc11f4a2b6fb61fc1360a0ab4e79141bba918841
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-32686
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Decimal\u0027"
          ],
          "packageName": "decimal",
          "packageURL": "pkg:hex/decimal",
          "product": "decimal",
          "programFiles": [
            "lib/decimal.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Decimal\u0027:new/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:parse/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:cast/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:add/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:sub/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:div/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:to_string/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:to_integer/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:round/3"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:compare/3"
            }
          ],
          "repo": "https://github.com/ericmj/decimal",
          "vendor": "ericmj",
          "versions": [
            {
              "lessThan": "3.0.0",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Decimal\u0027"
          ],
          "packageName": "ericmj/decimal",
          "packageURL": "pkg:github/ericmj/decimal",
          "product": "decimal",
          "programFiles": [
            "lib/decimal.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Decimal\u0027:new/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:parse/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:cast/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:add/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:sub/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:div/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:to_string/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:to_integer/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:round/3"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:compare/3"
            }
          ],
          "repo": "https://github.com/ericmj/decimal",
          "vendor": "ericmj",
          "versions": [
            {
              "lessThan": "6a523f3a73b8c9974540e21c7aa88f1258bb35ae",
              "status": "affected",
              "version": "bc11f4a2b6fb61fc1360a0ab4e79141bba918841",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new(\"1e1000000000\")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de consumo de recursos no controlado en ericmj decimal permite la denegaci\u00f3n de servicio remota no autenticada.\n\nLa biblioteca decimal no limita el exponente en la entrada analizada. Almacenar un decimal con un exponente muy grande (p. ej., Decimal.new(\u20191e1000000000\u2019)) es aceptado sin error. Las llamadas subsiguientes a funciones aritm\u00e9ticas (Decimal.add/2, Decimal.sub/2, Decimal.div/2), Decimal.to_string/2 con formato :normal o :xsd, Decimal.to_integer/1, Decimal.round/3, o Decimal.compare/3 con un umbral asignan memoria proporcional al valor del exponente, lo que puede agotar la memoria disponible y bloquear la VM de BEAM.\n\nCualquier aplicaci\u00f3n que acepte entrada decimal proporcionada por el usuario y posteriormente realice operaciones aritm\u00e9ticas, redondeo, conversi\u00f3n a entero o formato de cadena en ella est\u00e1 expuesta. Una \u00fanica solicitud maliciosa es suficiente para causar un bloqueo por falta de memoria.\n\nEste problema afecta a decimal: desde 0.1.0 antes de 3.0.0."
    }
  ],
  "id": "CVE-2026-32686",
  "lastModified": "2026-10-26T20:10:00.160",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-32686",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-08T22:42:13.343081Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-07T15:16:05.370",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-32686.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ericmj/decimal/commit/bc11f4a2b6fb61fc1360a0ab4e79141bba918841"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32686"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

GHSA-RHV4-8758-JX7V

Vulnerability from github – Published: 2026-05-12 15:09 – Updated: 2026-08-05 12:40

Summary

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Details

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp: - add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827). - to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513). - to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605). - round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874). - compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Severity

6.9 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "decimal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.0"
            },
            {
              "fixed": "3.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32686"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-12T15:09:20Z",
    "nvd_published_at": "2026-05-07T15:16:05Z",
    "severity": "MODERATE"
  },
  "details": "Summary\n`decimal` doesn\u0027t bound the exponent on parsed input, so something like `\"1e10000000\"` is parsed fine but then explodes the memory to more than 7GB if you run e.g. `Decimal.add(Decimal.parse(\"1e10000000\"), 1)` because for positive `exp`, the function tail-recurses with `coef * 10` and `exp - 1` per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.\n\n### Details\n`Decimal.new/parse/cast` happily store huge exponents. After that, a bunch of core paths allocate proportional to `exp`:\n- `add/sub/div` go through `add_align`, which calls `pow10(exp1 - exp2)` and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).\n- `to_string/2` with `:normal` (also `:xsd` and the `String.Chars` impl) does `:lists.duplicate(exp, ?0)` (lib/decimal.ex:1506, 1513).\n- `to_integer/1` recurses `coef * 10`, `exp - 1` once per unit of `exp` (lib/decimal.ex:1603-1605).\n- `round/3` does the same `:lists.duplicate` trick on the exp difference (lib/decimal.ex:1850, 1874).\n- `compare/3` with a threshold argument loops back into `add`/`sub`, so it\u0027s vulnerable too (lib/decimal.ex:331-332).\n\n### PoC\nAny of these will hang or OOM the BEAM:\n```elixir\nDecimal.add(Decimal.new(\"1\"), Decimal.new(\"1e1000000000\"))\nDecimal.to_string(Decimal.new(\"1e1000000000\"), :normal)\nDecimal.to_integer(Decimal.new(\"1e1000000000\"))\nDecimal.round(Decimal.new(\"1e1000000000\"))\n```\n\n### Impact\nUnauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto `:decimal` field \u2014 basically everywhere) and then does arithmetic, rounding, `to_integer`, or `to_string` on it is exposed. One request can kill the node with a Out-of-Memory exception.\n\n### Note on the security fixes done in version 2.4.0\nWhile `2.4.0` has the changes to mitigate this issue it\u0027s not considered as a patched version because it doesn\u0027t have them enabled by default.",
  "id": "GHSA-rhv4-8758-jx7v",
  "modified": "2026-08-05T12:40:51Z",
  "published": "2026-05-12T15:09:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32686"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-32686.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ericmj/decimal"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ericmj/decimal/releases/tag/v2.4.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ericmj/decimal/releases/tag/v3.0.0"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32686"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-32686 (GCVE-0-2026-32686)

FKIE_CVE-2026-32686

GHSA-RHV4-8758-JX7V

Details

PoC

Impact

Note on the security fixes done in version 2.4.0

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour