Search
Find a vulnerability
Search criteria
4 vulnerabilities by ericmj
CVE-2026-97853 (GCVE-0-2026-97853)
Vulnerability from nvd – Published: 2026-10-10 19:43 – Updated: 2026-10-15 18:09
VLAI
EPSS
VEX
Title
Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS
Summary
Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service.
Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the places argument instead of with the size of the result. For positive places it appends places zero digits to the coefficient as a charlist before converting it to an integer, and for negative places it builds a charlist of -places zero digits. A single call such as Decimal.round(Decimal.new("1.5"), -50_000_000) allocates about 5.5 GB of memory, which can exhaust available memory and get the BEAM VM killed. The oldest releases instead loop once per decimal place, consuming CPU in proportion to places.
Any application that passes a user-supplied number of decimal places or scale to Decimal.round/2 or Decimal.round/3 without bounding it is exposed. The input limits added for CVE-2026-32686 do not cover the places argument.
This issue affects decimal: from 0.1.0 before 3.1.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 17:51 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
6 references
Impacted products
Date Public
2026-10-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97853",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T17:51:21.251991Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:09:50.720Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Decimal\u0027"
],
"packageName": "decimal",
"packageURL": "pkg:hex/decimal",
"product": "decimal",
"programFiles": [
"lib/decimal.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Decimal\u0027:round/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:round/3"
}
],
"repo": "https://github.com/ericmj/decimal",
"vendor": "ericmj",
"versions": [
{
"lessThan": "3.1.2",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Decimal\u0027"
],
"packageName": "ericmj/decimal",
"packageURL": "pkg:github/ericmj/decimal",
"product": "decimal",
"programFiles": [
"lib/decimal.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Decimal\u0027:round/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:round/3"
}
],
"repo": "https://github.com/ericmj/decimal",
"vendor": "ericmj",
"versions": [
{
"changes": [
{
"at": "338f42c8cf6a9749ab70c5af04734c6050ca3dc6",
"status": "unaffected"
},
{
"at": "3c90af4c3c2dfa4bb4c138760a326dd0eb91822b",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "05bb73eb40ddef24eda782d905766f56a3660522",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.2",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Eric Meadows-J\u00f6nsson"
},
{
"lang": "en",
"type": "coordinator",
"value": "Eric Meadows-J\u00f6nsson"
}
],
"dateAssigned": "2026-10-09T16:40:13.000Z",
"datePublic": "2026-10-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMemory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eDecimal.round/3\u003c/code\u003e builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the \u003ccode\u003eplaces\u003c/code\u003e argument instead of with the size of the result. For positive \u003ccode\u003eplaces\u003c/code\u003e it appends \u003ccode\u003eplaces\u003c/code\u003e zero digits to the coefficient as a charlist before converting it to an integer, and for negative \u003ccode\u003eplaces\u003c/code\u003e it builds a charlist of \u003ccode\u003e-places\u003c/code\u003e zero digits. A single call such as \u003ccode\u003eDecimal.round(Decimal.new(\"1.5\"), -50_000_000)\u003c/code\u003e allocates about 5.5 GB of memory, which can exhaust available memory and get the BEAM VM killed. The oldest releases instead loop once per decimal place, consuming CPU in proportion to \u003ccode\u003eplaces\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eAny application that passes a user-supplied number of decimal places or scale to \u003ccode\u003eDecimal.round/2\u003c/code\u003e or \u003ccode\u003eDecimal.round/3\u003c/code\u003e without bounding it is exposed. The input limits added for CVE-2026-32686 do not cover the \u003ccode\u003eplaces\u003c/code\u003e argument.\u003c/p\u003e\n\u003cp\u003eThis issue affects decimal: from 0.1.0 before 3.1.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service.\n\n`Decimal.round/3` builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the `places` argument instead of with the size of the result. For positive `places` it appends `places` zero digits to the coefficient as a charlist before converting it to an integer, and for negative `places` it builds a charlist of `-places` zero digits. A single call such as `Decimal.round(Decimal.new(\"1.5\"), -50_000_000)` allocates about 5.5 GB of memory, which can exhaust available memory and get the BEAM VM killed. The oldest releases instead loop once per decimal place, consuming CPU in proportion to `places`.\n\nAny application that passes a user-supplied number of decimal places or scale to `Decimal.round/2` or `Decimal.round/3` without bounding it is exposed. The input limits added for CVE-2026-32686 do not cover the `places` argument.\n\nThis issue affects decimal: from 0.1.0 before 3.1.2."
}
],
"value": "Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service.\n\nDecimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the places argument instead of with the size of the result. For positive places it appends places zero digits to the coefficient as a charlist before converting it to an integer, and for negative places it builds a charlist of -places zero digits. A single call such as Decimal.round(Decimal.new(\"1.5\"), -50_000_000) allocates about 5.5 GB of memory, which can exhaust available memory and get the BEAM VM killed. The oldest releases instead loop once per decimal place, consuming CPU in proportion to places.\n\nAny application that passes a user-supplied number of decimal places or scale to Decimal.round/2 or Decimal.round/3 without bounding it is exposed. The input limits added for CVE-2026-32686 do not cover the places argument.\n\nThis issue affects decimal: from 0.1.0 before 3.1.2."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn attacker who controls the number of decimal places an application rounds to makes one \u003ccode\u003eDecimal.round/2,3\u003c/code\u003e call allocate memory in proportion to that number. A value of 50 million needs about 5.5 GB, enough to get the BEAM VM killed on hosts with less memory and take down every request it serves.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An attacker who controls the number of decimal places an application rounds to makes one `Decimal.round/2,3` call allocate memory in proportion to that number. A value of 50 million needs about 5.5 GB, enough to get the BEAM VM killed on hosts with less memory and take down every request it serves."
}
],
"value": "An attacker who controls the number of decimal places an application rounds to makes one Decimal.round/2,3 call allocate memory in proportion to that number. A value of 50 million needs about 5.5 GB, enough to get the BEAM VM killed on hosts with less memory and take down every request it serves."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T19:43:45.217Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-6c27-994x-c52f",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ericmj/decimal/security/advisories/GHSA-6c27-994x-c52f"
},
{
"name": "EEF CNA record for CVE-2026-97853",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-97853.html"
},
{
"name": "OSV record EEF-CVE-2026-97853",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-97853"
},
{
"name": "Introducing commit 05bb73e in ericmj/decimal",
"tags": [
"related"
],
"url": "https://github.com/ericmj/decimal/commit/05bb73eb40ddef24eda782d905766f56a3660522"
},
{
"name": "Fix commit 338f42c in ericmj/decimal",
"tags": [
"patch"
],
"url": "https://github.com/ericmj/decimal/commit/338f42c8cf6a9749ab70c5af04734c6050ca3dc6"
},
{
"name": "Fix commit 3c90af4 in ericmj/decimal",
"tags": [
"patch"
],
"url": "https://github.com/ericmj/decimal/commit/3c90af4c3c2dfa4bb4c138760a326dd0eb91822b"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eBound \u003ccode\u003eplaces\u003c/code\u003e before calling \u003ccode\u003eDecimal.round/2,3\u003c/code\u003e, for example to \u003ccode\u003e-34..34\u003c/code\u003e or to the scales the application supports.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Bound `places` before calling `Decimal.round/2,3`, for example to `-34..34` or to the scales the application supports."
}
],
"value": "Bound places before calling Decimal.round/2,3, for example to -34..34 or to the scales the application supports."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003e\u003ccode class=\"language-elixir\"\u003eMix.install([{:decimal, \"3.1.1\"}])\n\n# Allocates about 5.5 GB.\nDecimal.round(Decimal.new(\"1.5\"), -50_000_000)\n\n# Builds a 50 million element list, then raises SystemLimitError.\nDecimal.round(Decimal.new(\"1.5\"), 50_000_000)\n\u003c/code\u003e\u003c/pre\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "```elixir\nMix.install([{:decimal, \"3.1.1\"}])\n\n# Allocates about 5.5 GB.\nDecimal.round(Decimal.new(\"1.5\"), -50_000_000)\n\n# Builds a 50 million element list, then raises SystemLimitError.\nDecimal.round(Decimal.new(\"1.5\"), 50_000_000)\n```"
}
],
"value": "Mix.install([{:decimal, \"3.1.1\"}])\n\n# Allocates about 5.5 GB.\nDecimal.round(Decimal.new(\"1.5\"), -50_000_000)\n\n# Builds a 50 million element list, then raises SystemLimitError.\nDecimal.round(Decimal.new(\"1.5\"), 50_000_000)"
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003ccode\u003eDecimal.round/3\u003c/code\u003e sets the target exponent to \u003ccode\u003e-places\u003c/code\u003e and \u003ccode\u003edo_round/5\u003c/code\u003e materializes the coefficient at that exponent; \u003ccode\u003econtext/2\u003c/code\u003e only applies the precision afterwards.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePositive \u003ccode\u003eplaces\u003c/code\u003e (introduced in 1.3.0 by commit 7a83d27): \u003ccode\u003edigits ++ Enum.map(1..(exp - target_exp), fn _ -\u0026gt; ?0 end)\u003c/code\u003e followed by \u003ccode\u003e:erlang.list_to_integer/1\u003c/code\u003e (\u003ccode\u003elib/decimal.ex:2409\u003c/code\u003e in 3.1.1). The list is built before \u003ccode\u003elist_to_integer/1\u003c/code\u003e raises \u003ccode\u003eSystemLimitError\u003c/code\u003e for results over about 1.26 million digits, the BEAM integer size limit.\u003c/li\u003e\n\u003cli\u003eNegative \u003ccode\u003eplaces\u003c/code\u003e (since 1.4.0): \u003ccode\u003e:lists.duplicate(target_exp - exp, ?0) ++ digits\u003c/code\u003e (\u003ccode\u003elib/decimal.ex:2385-2386\u003c/code\u003e in 3.1.1).\u003c/li\u003e\n\u003cli\u003eReleases from 0.1.0 before 1.1.0: \u003ccode\u003edo_round\u003c/code\u003e (and in 1.0.1 \u003ccode\u003esplit_coef\u003c/code\u003e) recurses once per decimal place for negative \u003ccode\u003eplaces\u003c/code\u003e; 1.0.1 also multiplies a power of ten by 10 on every iteration. Established by reading the code; these releases do not compile on current Elixir.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eMeasured on OTP 29 with 3.1.1, one call per fresh VM:\u003c/p\u003e\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eCall\u003c/th\u003e\n\u003cth\u003eTime\u003c/th\u003e\n\u003cth\u003ePeak VM memory\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ccode\u003eDecimal.round(Decimal.new(\"1.5\"), -10_000_000)\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e0.25 s\u003c/td\u003e\n\u003ctd\u003e0.8 GB\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ccode\u003eDecimal.round(Decimal.new(\"1.5\"), -50_000_000)\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e1.2 s\u003c/td\u003e\n\u003ctd\u003e5.5 GB\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ccode\u003eDecimal.round(Decimal.new(\"1.5\"), 50_000_000)\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e2.1 s, then \u003ccode\u003eSystemLimitError\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e2.4 GB\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003eIn an \u003ccode\u003eelixir:1.20.4\u003c/code\u003e container started with \u003ccode\u003e--memory=2g\u003c/code\u003e, either of the last two calls got the VM killed (exit status 137). Over HTTP (Plug and Bandit) a 34-byte JSON body carrying \u003ccode\u003eplaces: -50_000_000\u003c/code\u003e returned after 1.25 s with server memory at 4.3 GB.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "`Decimal.round/3` sets the target exponent to `-places` and `do_round/5` materializes the coefficient at that exponent; `context/2` only applies the precision afterwards.\n\n- Positive `places` (introduced in 1.3.0 by commit 7a83d27): `digits ++ Enum.map(1..(exp - target_exp), fn _ -\u003e ?0 end)` followed by `:erlang.list_to_integer/1` (`lib/decimal.ex:2409` in 3.1.1). The list is built before `list_to_integer/1` raises `SystemLimitError` for results over about 1.26 million digits, the BEAM integer size limit.\n- Negative `places` (since 1.4.0): `:lists.duplicate(target_exp - exp, ?0) ++ digits` (`lib/decimal.ex:2385-2386` in 3.1.1).\n- Releases from 0.1.0 before 1.1.0: `do_round` (and in 1.0.1 `split_coef`) recurses once per decimal place for negative `places`; 1.0.1 also multiplies a power of ten by 10 on every iteration. Established by reading the code; these releases do not compile on current Elixir.\n\nMeasured on OTP 29 with 3.1.1, one call per fresh VM:\n\n| Call | Time | Peak VM memory |\n|---|---|---|\n| `Decimal.round(Decimal.new(\"1.5\"), -10_000_000)` | 0.25 s | 0.8 GB |\n| `Decimal.round(Decimal.new(\"1.5\"), -50_000_000)` | 1.2 s | 5.5 GB |\n| `Decimal.round(Decimal.new(\"1.5\"), 50_000_000)` | 2.1 s, then `SystemLimitError` | 2.4 GB |\n\nIn an `elixir:1.20.4` container started with `--memory=2g`, either of the last two calls got the VM killed (exit status 137). Over HTTP (Plug and Bandit) a 34-byte JSON body carrying `places: -50_000_000` returned after 1.25 s with server memory at 4.3 GB."
}
],
"value": "Decimal.round/3 sets the target exponent to -places and do_round/5 materializes the coefficient at that exponent; context/2 only applies the precision afterwards.\n\n* Positive places (introduced in 1.3.0 by commit 7a83d27): digits ++ Enum.map(1..(exp - target_exp), fn _ -\u003e ?0 end) followed by :erlang.list_to_integer/1 (lib/decimal.ex:2409 in 3.1.1). The list is built before list_to_integer/1 raises SystemLimitError for results over about 1.26 million digits, the BEAM integer size limit.\n* Negative places (since 1.4.0): :lists.duplicate(target_exp - exp, ?0) ++ digits (lib/decimal.ex:2385-2386 in 3.1.1).\n* Releases from 0.1.0 before 1.1.0: do_round (and in 1.0.1 split_coef) recurses once per decimal place for negative places; 1.0.1 also multiplies a power of ten by 10 on every iteration. Established by reading the code; these releases do not compile on current Elixir.\n\nMeasured on OTP 29 with 3.1.1, one call per fresh VM:\n\nCallTimePeak VM memoryDecimal.round(Decimal.new(\"1.5\"), -10_000_000)0.25 s0.8 GBDecimal.round(Decimal.new(\"1.5\"), -50_000_000)1.2 s5.5 GBDecimal.round(Decimal.new(\"1.5\"), 50_000_000)2.1 s, then SystemLimitError2.4 GB\n\nIn an elixir:1.20.4 container started with --memory=2g, either of the last two calls got the VM killed (exit status 137). Over HTTP (Plug and Bandit) a 34-byte JSON body carrying places: -50_000_000 returned after 1.25 s with server memory at 4.3 GB."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-97853",
"datePublished": "2026-10-10T19:43:45.217Z",
"dateReserved": "2026-10-09T00:30:01.645Z",
"dateUpdated": "2026-10-15T18:09:50.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-32686 (GCVE-0-2026-32686)
Vulnerability from nvd – Published: 2026-05-07 14:04 – Updated: 2026-09-08 13:08
VLAI
EPSS
VEX
Title
Unbounded exponent in decimal enables unauthenticated DoS
Summary
Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.
The decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new("1e1000000000")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.
Any application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.
This issue affects decimal: from 0.1.0 before 3.0.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-08 22:42 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ericmj/decimal/security/adviso… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-32686.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-32686 | related |
| https://github.com/ericmj/decimal/commit/bc11f4a2… | related |
| https://github.com/ericmj/decimal/commit/6a523f3a… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32686",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-08T22:42:13.343081Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-08T22:43:03.396Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Decimal\u0027"
],
"packageName": "decimal",
"packageURL": "pkg:hex/decimal",
"product": "decimal",
"programFiles": [
"lib/decimal.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Decimal\u0027:new/1"
},
{
"name": "\u0027Elixir.Decimal\u0027:parse/1"
},
{
"name": "\u0027Elixir.Decimal\u0027:cast/1"
},
{
"name": "\u0027Elixir.Decimal\u0027:add/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:sub/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:div/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:to_string/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:to_integer/1"
},
{
"name": "\u0027Elixir.Decimal\u0027:round/3"
},
{
"name": "\u0027Elixir.Decimal\u0027:compare/3"
}
],
"repo": "https://github.com/ericmj/decimal",
"vendor": "ericmj",
"versions": [
{
"lessThan": "3.0.0",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Decimal\u0027"
],
"packageName": "ericmj/decimal",
"packageURL": "pkg:github/ericmj/decimal",
"product": "decimal",
"programFiles": [
"lib/decimal.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Decimal\u0027:new/1"
},
{
"name": "\u0027Elixir.Decimal\u0027:parse/1"
},
{
"name": "\u0027Elixir.Decimal\u0027:cast/1"
},
{
"name": "\u0027Elixir.Decimal\u0027:add/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:sub/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:div/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:to_string/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:to_integer/1"
},
{
"name": "\u0027Elixir.Decimal\u0027:round/3"
},
{
"name": "\u0027Elixir.Decimal\u0027:compare/3"
}
],
"repo": "https://github.com/ericmj/decimal",
"vendor": "ericmj",
"versions": [
{
"lessThan": "6a523f3a73b8c9974540e21c7aa88f1258bb35ae",
"status": "affected",
"version": "bc11f4a2b6fb61fc1360a0ab4e79141bba918841",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.0.0",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Eric Meadows-J\u00f6nsson / Hex.pm"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Jos\u00e9 Valim"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Wojtek Mach"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "ruslandoga"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Matthew Johnston"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003edecimal\u003c/code\u003e library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. \u003ccode\u003eDecimal.new(\"1e1000000000\")\u003c/code\u003e) is accepted without error. Subsequent calls to arithmetic functions (\u003ccode\u003eDecimal.add/2\u003c/code\u003e, \u003ccode\u003eDecimal.sub/2\u003c/code\u003e, \u003ccode\u003eDecimal.div/2\u003c/code\u003eM), \u003ccode\u003eDecimal.to_string/2\u003c/code\u003eM with \u003ccode\u003e:normal\u003c/code\u003eM or \u003ccode\u003e:xsd\u003c/code\u003eM format, \u003ccode\u003eDecimal.to_integer/1\u003c/code\u003eM, \u003ccode\u003eDecimal.round/3\u003c/code\u003eM, or \u003ccode\u003eDecimal.compare/3\u003c/code\u003eM with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\u003c/p\u003e\n\u003cp\u003eAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\u003c/p\u003e\n\u003cp\u003eThis issue affects decimal: from 0.1.0 before 3.0.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe `decimal` library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. `Decimal.new(\"1e1000000000\")`) is accepted without error. Subsequent calls to arithmetic functions (`Decimal.add/2`, `Decimal.sub/2`, `Decimal.div/2`M), `Decimal.to_string/2`M with `:normal`M or `:xsd`M format, `Decimal.to_integer/1`M, `Decimal.round/3`M, or `Decimal.compare/3`M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0."
}
],
"value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new(\"1e1000000000\")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:08:41.575Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"
},
{
"name": "EEF CNA record for CVE-2026-32686",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-32686.html"
},
{
"name": "OSV record EEF-CVE-2026-32686",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-32686"
},
{
"name": "Introducing commit bc11f4a in ericmj/decimal",
"tags": [
"related"
],
"url": "https://github.com/ericmj/decimal/commit/bc11f4a2b6fb61fc1360a0ab4e79141bba918841"
},
{
"name": "Fix commit 6a523f3 in ericmj/decimal",
"tags": [
"patch"
],
"url": "https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded exponent in decimal enables unauthenticated DoS"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-32686",
"datePublished": "2026-05-07T14:04:47.222Z",
"dateReserved": "2026-03-13T09:12:14.474Z",
"dateUpdated": "2026-09-08T13:08:41.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97853 (GCVE-0-2026-97853)
Vulnerability from cvelistv5 – Published: 2026-10-10 19:43 – Updated: 2026-10-15 18:09
VLAI
EPSS
VEX
Title
Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS
Summary
Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service.
Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the places argument instead of with the size of the result. For positive places it appends places zero digits to the coefficient as a charlist before converting it to an integer, and for negative places it builds a charlist of -places zero digits. A single call such as Decimal.round(Decimal.new("1.5"), -50_000_000) allocates about 5.5 GB of memory, which can exhaust available memory and get the BEAM VM killed. The oldest releases instead loop once per decimal place, consuming CPU in proportion to places.
Any application that passes a user-supplied number of decimal places or scale to Decimal.round/2 or Decimal.round/3 without bounding it is exposed. The input limits added for CVE-2026-32686 do not cover the places argument.
This issue affects decimal: from 0.1.0 before 3.1.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 17:51 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
6 references
Impacted products
Date Public
2026-10-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97853",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T17:51:21.251991Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:09:50.720Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Decimal\u0027"
],
"packageName": "decimal",
"packageURL": "pkg:hex/decimal",
"product": "decimal",
"programFiles": [
"lib/decimal.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Decimal\u0027:round/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:round/3"
}
],
"repo": "https://github.com/ericmj/decimal",
"vendor": "ericmj",
"versions": [
{
"lessThan": "3.1.2",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Decimal\u0027"
],
"packageName": "ericmj/decimal",
"packageURL": "pkg:github/ericmj/decimal",
"product": "decimal",
"programFiles": [
"lib/decimal.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Decimal\u0027:round/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:round/3"
}
],
"repo": "https://github.com/ericmj/decimal",
"vendor": "ericmj",
"versions": [
{
"changes": [
{
"at": "338f42c8cf6a9749ab70c5af04734c6050ca3dc6",
"status": "unaffected"
},
{
"at": "3c90af4c3c2dfa4bb4c138760a326dd0eb91822b",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "05bb73eb40ddef24eda782d905766f56a3660522",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.2",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Eric Meadows-J\u00f6nsson"
},
{
"lang": "en",
"type": "coordinator",
"value": "Eric Meadows-J\u00f6nsson"
}
],
"dateAssigned": "2026-10-09T16:40:13.000Z",
"datePublic": "2026-10-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMemory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eDecimal.round/3\u003c/code\u003e builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the \u003ccode\u003eplaces\u003c/code\u003e argument instead of with the size of the result. For positive \u003ccode\u003eplaces\u003c/code\u003e it appends \u003ccode\u003eplaces\u003c/code\u003e zero digits to the coefficient as a charlist before converting it to an integer, and for negative \u003ccode\u003eplaces\u003c/code\u003e it builds a charlist of \u003ccode\u003e-places\u003c/code\u003e zero digits. A single call such as \u003ccode\u003eDecimal.round(Decimal.new(\"1.5\"), -50_000_000)\u003c/code\u003e allocates about 5.5 GB of memory, which can exhaust available memory and get the BEAM VM killed. The oldest releases instead loop once per decimal place, consuming CPU in proportion to \u003ccode\u003eplaces\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eAny application that passes a user-supplied number of decimal places or scale to \u003ccode\u003eDecimal.round/2\u003c/code\u003e or \u003ccode\u003eDecimal.round/3\u003c/code\u003e without bounding it is exposed. The input limits added for CVE-2026-32686 do not cover the \u003ccode\u003eplaces\u003c/code\u003e argument.\u003c/p\u003e\n\u003cp\u003eThis issue affects decimal: from 0.1.0 before 3.1.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service.\n\n`Decimal.round/3` builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the `places` argument instead of with the size of the result. For positive `places` it appends `places` zero digits to the coefficient as a charlist before converting it to an integer, and for negative `places` it builds a charlist of `-places` zero digits. A single call such as `Decimal.round(Decimal.new(\"1.5\"), -50_000_000)` allocates about 5.5 GB of memory, which can exhaust available memory and get the BEAM VM killed. The oldest releases instead loop once per decimal place, consuming CPU in proportion to `places`.\n\nAny application that passes a user-supplied number of decimal places or scale to `Decimal.round/2` or `Decimal.round/3` without bounding it is exposed. The input limits added for CVE-2026-32686 do not cover the `places` argument.\n\nThis issue affects decimal: from 0.1.0 before 3.1.2."
}
],
"value": "Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service.\n\nDecimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the places argument instead of with the size of the result. For positive places it appends places zero digits to the coefficient as a charlist before converting it to an integer, and for negative places it builds a charlist of -places zero digits. A single call such as Decimal.round(Decimal.new(\"1.5\"), -50_000_000) allocates about 5.5 GB of memory, which can exhaust available memory and get the BEAM VM killed. The oldest releases instead loop once per decimal place, consuming CPU in proportion to places.\n\nAny application that passes a user-supplied number of decimal places or scale to Decimal.round/2 or Decimal.round/3 without bounding it is exposed. The input limits added for CVE-2026-32686 do not cover the places argument.\n\nThis issue affects decimal: from 0.1.0 before 3.1.2."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn attacker who controls the number of decimal places an application rounds to makes one \u003ccode\u003eDecimal.round/2,3\u003c/code\u003e call allocate memory in proportion to that number. A value of 50 million needs about 5.5 GB, enough to get the BEAM VM killed on hosts with less memory and take down every request it serves.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An attacker who controls the number of decimal places an application rounds to makes one `Decimal.round/2,3` call allocate memory in proportion to that number. A value of 50 million needs about 5.5 GB, enough to get the BEAM VM killed on hosts with less memory and take down every request it serves."
}
],
"value": "An attacker who controls the number of decimal places an application rounds to makes one Decimal.round/2,3 call allocate memory in proportion to that number. A value of 50 million needs about 5.5 GB, enough to get the BEAM VM killed on hosts with less memory and take down every request it serves."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T19:43:45.217Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-6c27-994x-c52f",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ericmj/decimal/security/advisories/GHSA-6c27-994x-c52f"
},
{
"name": "EEF CNA record for CVE-2026-97853",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-97853.html"
},
{
"name": "OSV record EEF-CVE-2026-97853",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-97853"
},
{
"name": "Introducing commit 05bb73e in ericmj/decimal",
"tags": [
"related"
],
"url": "https://github.com/ericmj/decimal/commit/05bb73eb40ddef24eda782d905766f56a3660522"
},
{
"name": "Fix commit 338f42c in ericmj/decimal",
"tags": [
"patch"
],
"url": "https://github.com/ericmj/decimal/commit/338f42c8cf6a9749ab70c5af04734c6050ca3dc6"
},
{
"name": "Fix commit 3c90af4 in ericmj/decimal",
"tags": [
"patch"
],
"url": "https://github.com/ericmj/decimal/commit/3c90af4c3c2dfa4bb4c138760a326dd0eb91822b"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eBound \u003ccode\u003eplaces\u003c/code\u003e before calling \u003ccode\u003eDecimal.round/2,3\u003c/code\u003e, for example to \u003ccode\u003e-34..34\u003c/code\u003e or to the scales the application supports.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Bound `places` before calling `Decimal.round/2,3`, for example to `-34..34` or to the scales the application supports."
}
],
"value": "Bound places before calling Decimal.round/2,3, for example to -34..34 or to the scales the application supports."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003e\u003ccode class=\"language-elixir\"\u003eMix.install([{:decimal, \"3.1.1\"}])\n\n# Allocates about 5.5 GB.\nDecimal.round(Decimal.new(\"1.5\"), -50_000_000)\n\n# Builds a 50 million element list, then raises SystemLimitError.\nDecimal.round(Decimal.new(\"1.5\"), 50_000_000)\n\u003c/code\u003e\u003c/pre\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "```elixir\nMix.install([{:decimal, \"3.1.1\"}])\n\n# Allocates about 5.5 GB.\nDecimal.round(Decimal.new(\"1.5\"), -50_000_000)\n\n# Builds a 50 million element list, then raises SystemLimitError.\nDecimal.round(Decimal.new(\"1.5\"), 50_000_000)\n```"
}
],
"value": "Mix.install([{:decimal, \"3.1.1\"}])\n\n# Allocates about 5.5 GB.\nDecimal.round(Decimal.new(\"1.5\"), -50_000_000)\n\n# Builds a 50 million element list, then raises SystemLimitError.\nDecimal.round(Decimal.new(\"1.5\"), 50_000_000)"
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003ccode\u003eDecimal.round/3\u003c/code\u003e sets the target exponent to \u003ccode\u003e-places\u003c/code\u003e and \u003ccode\u003edo_round/5\u003c/code\u003e materializes the coefficient at that exponent; \u003ccode\u003econtext/2\u003c/code\u003e only applies the precision afterwards.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePositive \u003ccode\u003eplaces\u003c/code\u003e (introduced in 1.3.0 by commit 7a83d27): \u003ccode\u003edigits ++ Enum.map(1..(exp - target_exp), fn _ -\u0026gt; ?0 end)\u003c/code\u003e followed by \u003ccode\u003e:erlang.list_to_integer/1\u003c/code\u003e (\u003ccode\u003elib/decimal.ex:2409\u003c/code\u003e in 3.1.1). The list is built before \u003ccode\u003elist_to_integer/1\u003c/code\u003e raises \u003ccode\u003eSystemLimitError\u003c/code\u003e for results over about 1.26 million digits, the BEAM integer size limit.\u003c/li\u003e\n\u003cli\u003eNegative \u003ccode\u003eplaces\u003c/code\u003e (since 1.4.0): \u003ccode\u003e:lists.duplicate(target_exp - exp, ?0) ++ digits\u003c/code\u003e (\u003ccode\u003elib/decimal.ex:2385-2386\u003c/code\u003e in 3.1.1).\u003c/li\u003e\n\u003cli\u003eReleases from 0.1.0 before 1.1.0: \u003ccode\u003edo_round\u003c/code\u003e (and in 1.0.1 \u003ccode\u003esplit_coef\u003c/code\u003e) recurses once per decimal place for negative \u003ccode\u003eplaces\u003c/code\u003e; 1.0.1 also multiplies a power of ten by 10 on every iteration. Established by reading the code; these releases do not compile on current Elixir.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eMeasured on OTP 29 with 3.1.1, one call per fresh VM:\u003c/p\u003e\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eCall\u003c/th\u003e\n\u003cth\u003eTime\u003c/th\u003e\n\u003cth\u003ePeak VM memory\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ccode\u003eDecimal.round(Decimal.new(\"1.5\"), -10_000_000)\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e0.25 s\u003c/td\u003e\n\u003ctd\u003e0.8 GB\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ccode\u003eDecimal.round(Decimal.new(\"1.5\"), -50_000_000)\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e1.2 s\u003c/td\u003e\n\u003ctd\u003e5.5 GB\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ccode\u003eDecimal.round(Decimal.new(\"1.5\"), 50_000_000)\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e2.1 s, then \u003ccode\u003eSystemLimitError\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e2.4 GB\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003eIn an \u003ccode\u003eelixir:1.20.4\u003c/code\u003e container started with \u003ccode\u003e--memory=2g\u003c/code\u003e, either of the last two calls got the VM killed (exit status 137). Over HTTP (Plug and Bandit) a 34-byte JSON body carrying \u003ccode\u003eplaces: -50_000_000\u003c/code\u003e returned after 1.25 s with server memory at 4.3 GB.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "`Decimal.round/3` sets the target exponent to `-places` and `do_round/5` materializes the coefficient at that exponent; `context/2` only applies the precision afterwards.\n\n- Positive `places` (introduced in 1.3.0 by commit 7a83d27): `digits ++ Enum.map(1..(exp - target_exp), fn _ -\u003e ?0 end)` followed by `:erlang.list_to_integer/1` (`lib/decimal.ex:2409` in 3.1.1). The list is built before `list_to_integer/1` raises `SystemLimitError` for results over about 1.26 million digits, the BEAM integer size limit.\n- Negative `places` (since 1.4.0): `:lists.duplicate(target_exp - exp, ?0) ++ digits` (`lib/decimal.ex:2385-2386` in 3.1.1).\n- Releases from 0.1.0 before 1.1.0: `do_round` (and in 1.0.1 `split_coef`) recurses once per decimal place for negative `places`; 1.0.1 also multiplies a power of ten by 10 on every iteration. Established by reading the code; these releases do not compile on current Elixir.\n\nMeasured on OTP 29 with 3.1.1, one call per fresh VM:\n\n| Call | Time | Peak VM memory |\n|---|---|---|\n| `Decimal.round(Decimal.new(\"1.5\"), -10_000_000)` | 0.25 s | 0.8 GB |\n| `Decimal.round(Decimal.new(\"1.5\"), -50_000_000)` | 1.2 s | 5.5 GB |\n| `Decimal.round(Decimal.new(\"1.5\"), 50_000_000)` | 2.1 s, then `SystemLimitError` | 2.4 GB |\n\nIn an `elixir:1.20.4` container started with `--memory=2g`, either of the last two calls got the VM killed (exit status 137). Over HTTP (Plug and Bandit) a 34-byte JSON body carrying `places: -50_000_000` returned after 1.25 s with server memory at 4.3 GB."
}
],
"value": "Decimal.round/3 sets the target exponent to -places and do_round/5 materializes the coefficient at that exponent; context/2 only applies the precision afterwards.\n\n* Positive places (introduced in 1.3.0 by commit 7a83d27): digits ++ Enum.map(1..(exp - target_exp), fn _ -\u003e ?0 end) followed by :erlang.list_to_integer/1 (lib/decimal.ex:2409 in 3.1.1). The list is built before list_to_integer/1 raises SystemLimitError for results over about 1.26 million digits, the BEAM integer size limit.\n* Negative places (since 1.4.0): :lists.duplicate(target_exp - exp, ?0) ++ digits (lib/decimal.ex:2385-2386 in 3.1.1).\n* Releases from 0.1.0 before 1.1.0: do_round (and in 1.0.1 split_coef) recurses once per decimal place for negative places; 1.0.1 also multiplies a power of ten by 10 on every iteration. Established by reading the code; these releases do not compile on current Elixir.\n\nMeasured on OTP 29 with 3.1.1, one call per fresh VM:\n\nCallTimePeak VM memoryDecimal.round(Decimal.new(\"1.5\"), -10_000_000)0.25 s0.8 GBDecimal.round(Decimal.new(\"1.5\"), -50_000_000)1.2 s5.5 GBDecimal.round(Decimal.new(\"1.5\"), 50_000_000)2.1 s, then SystemLimitError2.4 GB\n\nIn an elixir:1.20.4 container started with --memory=2g, either of the last two calls got the VM killed (exit status 137). Over HTTP (Plug and Bandit) a 34-byte JSON body carrying places: -50_000_000 returned after 1.25 s with server memory at 4.3 GB."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-97853",
"datePublished": "2026-10-10T19:43:45.217Z",
"dateReserved": "2026-10-09T00:30:01.645Z",
"dateUpdated": "2026-10-15T18:09:50.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-32686 (GCVE-0-2026-32686)
Vulnerability from cvelistv5 – Published: 2026-05-07 14:04 – Updated: 2026-09-08 13:08
VLAI
EPSS
VEX
Title
Unbounded exponent in decimal enables unauthenticated DoS
Summary
Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.
The decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new("1e1000000000")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.
Any application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.
This issue affects decimal: from 0.1.0 before 3.0.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-08 22:42 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ericmj/decimal/security/adviso… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-32686.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-32686 | related |
| https://github.com/ericmj/decimal/commit/bc11f4a2… | related |
| https://github.com/ericmj/decimal/commit/6a523f3a… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32686",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-08T22:42:13.343081Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-08T22:43:03.396Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Decimal\u0027"
],
"packageName": "decimal",
"packageURL": "pkg:hex/decimal",
"product": "decimal",
"programFiles": [
"lib/decimal.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Decimal\u0027:new/1"
},
{
"name": "\u0027Elixir.Decimal\u0027:parse/1"
},
{
"name": "\u0027Elixir.Decimal\u0027:cast/1"
},
{
"name": "\u0027Elixir.Decimal\u0027:add/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:sub/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:div/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:to_string/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:to_integer/1"
},
{
"name": "\u0027Elixir.Decimal\u0027:round/3"
},
{
"name": "\u0027Elixir.Decimal\u0027:compare/3"
}
],
"repo": "https://github.com/ericmj/decimal",
"vendor": "ericmj",
"versions": [
{
"lessThan": "3.0.0",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Decimal\u0027"
],
"packageName": "ericmj/decimal",
"packageURL": "pkg:github/ericmj/decimal",
"product": "decimal",
"programFiles": [
"lib/decimal.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Decimal\u0027:new/1"
},
{
"name": "\u0027Elixir.Decimal\u0027:parse/1"
},
{
"name": "\u0027Elixir.Decimal\u0027:cast/1"
},
{
"name": "\u0027Elixir.Decimal\u0027:add/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:sub/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:div/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:to_string/2"
},
{
"name": "\u0027Elixir.Decimal\u0027:to_integer/1"
},
{
"name": "\u0027Elixir.Decimal\u0027:round/3"
},
{
"name": "\u0027Elixir.Decimal\u0027:compare/3"
}
],
"repo": "https://github.com/ericmj/decimal",
"vendor": "ericmj",
"versions": [
{
"lessThan": "6a523f3a73b8c9974540e21c7aa88f1258bb35ae",
"status": "affected",
"version": "bc11f4a2b6fb61fc1360a0ab4e79141bba918841",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.0.0",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Eric Meadows-J\u00f6nsson / Hex.pm"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Jos\u00e9 Valim"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Wojtek Mach"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "ruslandoga"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Matthew Johnston"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003edecimal\u003c/code\u003e library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. \u003ccode\u003eDecimal.new(\"1e1000000000\")\u003c/code\u003e) is accepted without error. Subsequent calls to arithmetic functions (\u003ccode\u003eDecimal.add/2\u003c/code\u003e, \u003ccode\u003eDecimal.sub/2\u003c/code\u003e, \u003ccode\u003eDecimal.div/2\u003c/code\u003eM), \u003ccode\u003eDecimal.to_string/2\u003c/code\u003eM with \u003ccode\u003e:normal\u003c/code\u003eM or \u003ccode\u003e:xsd\u003c/code\u003eM format, \u003ccode\u003eDecimal.to_integer/1\u003c/code\u003eM, \u003ccode\u003eDecimal.round/3\u003c/code\u003eM, or \u003ccode\u003eDecimal.compare/3\u003c/code\u003eM with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\u003c/p\u003e\n\u003cp\u003eAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\u003c/p\u003e\n\u003cp\u003eThis issue affects decimal: from 0.1.0 before 3.0.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe `decimal` library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. `Decimal.new(\"1e1000000000\")`) is accepted without error. Subsequent calls to arithmetic functions (`Decimal.add/2`, `Decimal.sub/2`, `Decimal.div/2`M), `Decimal.to_string/2`M with `:normal`M or `:xsd`M format, `Decimal.to_integer/1`M, `Decimal.round/3`M, or `Decimal.compare/3`M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0."
}
],
"value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new(\"1e1000000000\")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:08:41.575Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"
},
{
"name": "EEF CNA record for CVE-2026-32686",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-32686.html"
},
{
"name": "OSV record EEF-CVE-2026-32686",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-32686"
},
{
"name": "Introducing commit bc11f4a in ericmj/decimal",
"tags": [
"related"
],
"url": "https://github.com/ericmj/decimal/commit/bc11f4a2b6fb61fc1360a0ab4e79141bba918841"
},
{
"name": "Fix commit 6a523f3 in ericmj/decimal",
"tags": [
"patch"
],
"url": "https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded exponent in decimal enables unauthenticated DoS"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-32686",
"datePublished": "2026-05-07T14:04:47.222Z",
"dateReserved": "2026-03-13T09:12:14.474Z",
"dateUpdated": "2026-09-08T13:08:41.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}