Vulnerability-Lookup

CVE-2026-32686 (GCVE-0-2026-32686)

Vulnerability from cvelistv5 – Published: 2026-05-07 14:04 – Updated: 2026-05-09 04:18

Title

Unbounded exponent in decimal enables unauthenticated DoS

Summary

Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service. The decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new("1e1000000000")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2), Decimal.to_string/2 with :normal or :xsd format, Decimal.to_integer/1, Decimal.round/3, or Decimal.compare/3 with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM. Any application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash. This issue affects decimal: from 0.1.0 before 3.0.0.

Severity ?

6.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

EEF

References

4 references

URL	Tags
https://github.com/ericmj/decimal/security/adviso…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-32686.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-32686	related
https://github.com/ericmj/decimal/commit/6a523f3a…	patch

Impacted products

2 products

Vendor	Product	Version
ericmj	decimal	Affected: 0.1.0 , < 3.0.0 (semver) cpe:2.3:a:ericmj:decimal::::::::
ericmj	decimal	Affected: bc11f4a2b6fb61fc1360a0ab4e79141bba918841 , < 6a523f3a73b8c9974540e21c7aa88f1258bb35ae (git) cpe:2.3:a:ericmj:decimal::::::::

Credits

Peter Ullrich Eric Meadows-Jönsson José Valim Wojtek Mach Jonatan Männchen ruslandoga Matthew Johnston

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32686",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-08T22:42:13.343081Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-08T22:43:03.396Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://hex.pm",
          "cpes": [
            "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "affected",
          "modules": [
            "\u0027Elixir.Decimal\u0027"
          ],
          "packageName": "decimal",
          "packageURL": "pkg:hex/decimal",
          "product": "decimal",
          "programFiles": [
            "lib/decimal.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Decimal\u0027:new/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:parse/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:cast/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:add/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:sub/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:div/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:to_string/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:to_integer/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:round/3"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:compare/3"
            }
          ],
          "repo": "https://github.com/ericmj/decimal",
          "vendor": "ericmj",
          "versions": [
            {
              "lessThan": "3.0.0",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "affected",
          "modules": [
            "\u0027Elixir.Decimal\u0027"
          ],
          "packageName": "ericmj/decimal",
          "packageURL": "pkg:github/ericmj/decimal",
          "product": "decimal",
          "programFiles": [
            "lib/decimal.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Decimal\u0027:new/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:parse/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:cast/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:add/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:sub/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:div/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:to_string/2"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:to_integer/1"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:round/3"
            },
            {
              "name": "\u0027Elixir.Decimal\u0027:compare/3"
            }
          ],
          "repo": "https://github.com/ericmj/decimal",
          "vendor": "ericmj",
          "versions": [
            {
              "lessThan": "6a523f3a73b8c9974540e21c7aa88f1258bb35ae",
              "status": "affected",
              "version": "bc11f4a2b6fb61fc1360a0ab4e79141bba918841",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.0.0",
                  "versionStartIncluding": "0.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "AND"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Eric Meadows-J\u00f6nsson"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Jos\u00e9 Valim"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Wojtek Mach"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "ruslandoga"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Matthew Johnston"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\u003cp\u003eThe \u003ctt\u003edecimal\u003c/tt\u003e library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. \u003ctt\u003eDecimal.new(\"1e1000000000\")\u003c/tt\u003e) is accepted without error. Subsequent calls to arithmetic functions (\u003ctt\u003eDecimal.add/2\u003c/tt\u003e, \u003ctt\u003eDecimal.sub/2\u003c/tt\u003e, \u003ctt\u003eDecimal.div/2\u003c/tt\u003e), \u003ctt\u003eDecimal.to_string/2\u003c/tt\u003e with \u003ctt\u003e:normal\u003c/tt\u003e or \u003ctt\u003e:xsd\u003c/tt\u003e format, \u003ctt\u003eDecimal.to_integer/1\u003c/tt\u003e, \u003ctt\u003eDecimal.round/3\u003c/tt\u003e, or \u003ctt\u003eDecimal.compare/3\u003c/tt\u003e with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\u003c/p\u003e\u003cp\u003eAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\u003c/p\u003e\u003cp\u003eThis issue affects decimal: from 0.1.0 before 3.0.0.\u003c/p\u003e"
            }
          ],
          "value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new(\"1e1000000000\")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2), Decimal.to_string/2 with :normal or :xsd format, Decimal.to_integer/1, Decimal.round/3, or Decimal.compare/3 with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-09T04:18:13.116Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-32686.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32686"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unbounded exponent in decimal enables unauthenticated DoS",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-32686",
    "datePublished": "2026-05-07T14:04:47.222Z",
    "dateReserved": "2026-03-13T09:12:14.474Z",
    "dateUpdated": "2026-05-09T04:18:13.116Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-32686",
      "date": "2026-05-17",
      "epss": "0.00094",
      "percentile": "0.2592"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-32686\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-05-07T15:16:05.370\",\"lastModified\":\"2026-05-08T23:16:35.113\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\\n\\nThe decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new(\\\"1e1000000000\\\")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2), Decimal.to_string/2 with :normal or :xsd format, Decimal.to_integer/1, Decimal.round/3, or Decimal.compare/3 with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\\n\\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\\n\\nThis issue affects decimal: from 0.1.0 before 3.0.0.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":6.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-32686.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-32686\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-32686\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-08T22:42:13.343081Z\"}}}], \"references\": [{\"url\": \"https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-08T22:42:55.384Z\"}}], \"cna\": {\"title\": \"Unbounded exponent in decimal enables unauthenticated DoS\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Eric Meadows-J\\u00f6nsson\"}, {\"lang\": \"en\", \"type\": \"remediation reviewer\", \"value\": \"Jos\\u00e9 Valim\"}, {\"lang\": \"en\", \"type\": \"remediation reviewer\", \"value\": \"Wojtek Mach\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Jonatan M\\u00e4nnchen\"}, {\"lang\": \"en\", \"type\": \"remediation reviewer\", \"value\": \"ruslandoga\"}, {\"lang\": \"en\", \"type\": \"remediation reviewer\", \"value\": \"Matthew Johnston\"}], \"impacts\": [{\"capecId\": \"CAPEC-130\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-130 Excessive Allocation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 6.9, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ericmj/decimal\", \"vendor\": \"ericmj\", \"modules\": [\"\u0027Elixir.Decimal\u0027\"], \"product\": \"decimal\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.1.0\", \"lessThan\": \"3.0.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/decimal\", \"packageName\": \"decimal\", \"programFiles\": [\"lib/decimal.ex\"], \"collectionURL\": \"https://hex.pm\", \"defaultStatus\": \"affected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.Decimal\u0027:new/1\"}, {\"name\": \"\u0027Elixir.Decimal\u0027:parse/1\"}, {\"name\": \"\u0027Elixir.Decimal\u0027:cast/1\"}, {\"name\": \"\u0027Elixir.Decimal\u0027:add/2\"}, {\"name\": \"\u0027Elixir.Decimal\u0027:sub/2\"}, {\"name\": \"\u0027Elixir.Decimal\u0027:div/2\"}, {\"name\": \"\u0027Elixir.Decimal\u0027:to_string/2\"}, {\"name\": \"\u0027Elixir.Decimal\u0027:to_integer/1\"}, {\"name\": \"\u0027Elixir.Decimal\u0027:round/3\"}, {\"name\": \"\u0027Elixir.Decimal\u0027:compare/3\"}]}, {\"cpes\": [\"cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ericmj/decimal\", \"vendor\": \"ericmj\", \"modules\": [\"\u0027Elixir.Decimal\u0027\"], \"product\": \"decimal\", \"versions\": [{\"status\": \"affected\", \"version\": \"bc11f4a2b6fb61fc1360a0ab4e79141bba918841\", \"lessThan\": \"6a523f3a73b8c9974540e21c7aa88f1258bb35ae\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/ericmj/decimal\", \"packageName\": \"ericmj/decimal\", \"programFiles\": [\"lib/decimal.ex\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"affected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.Decimal\u0027:new/1\"}, {\"name\": \"\u0027Elixir.Decimal\u0027:parse/1\"}, {\"name\": \"\u0027Elixir.Decimal\u0027:cast/1\"}, {\"name\": \"\u0027Elixir.Decimal\u0027:add/2\"}, {\"name\": \"\u0027Elixir.Decimal\u0027:sub/2\"}, {\"name\": \"\u0027Elixir.Decimal\u0027:div/2\"}, {\"name\": \"\u0027Elixir.Decimal\u0027:to_string/2\"}, {\"name\": \"\u0027Elixir.Decimal\u0027:to_integer/1\"}, {\"name\": \"\u0027Elixir.Decimal\u0027:round/3\"}, {\"name\": \"\u0027Elixir.Decimal\u0027:compare/3\"}]}], \"references\": [{\"url\": \"https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-32686.html\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-32686\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\\n\\nThe decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new(\\\"1e1000000000\\\")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2), Decimal.to_string/2 with :normal or :xsd format, Decimal.to_integer/1, Decimal.round/3, or Decimal.compare/3 with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\\n\\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\\n\\nThis issue affects decimal: from 0.1.0 before 3.0.0.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\u003cp\u003eThe \u003ctt\u003edecimal\u003c/tt\u003e library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. \u003ctt\u003eDecimal.new(\\\"1e1000000000\\\")\u003c/tt\u003e) is accepted without error. Subsequent calls to arithmetic functions (\u003ctt\u003eDecimal.add/2\u003c/tt\u003e, \u003ctt\u003eDecimal.sub/2\u003c/tt\u003e, \u003ctt\u003eDecimal.div/2\u003c/tt\u003e), \u003ctt\u003eDecimal.to_string/2\u003c/tt\u003e with \u003ctt\u003e:normal\u003c/tt\u003e or \u003ctt\u003e:xsd\u003c/tt\u003e format, \u003ctt\u003eDecimal.to_integer/1\u003c/tt\u003e, \u003ctt\u003eDecimal.round/3\u003c/tt\u003e, or \u003ctt\u003eDecimal.compare/3\u003c/tt\u003e with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\u003c/p\u003e\u003cp\u003eAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\u003c/p\u003e\u003cp\u003eThis issue affects decimal: from 0.1.0 before 3.0.0.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400 Uncontrolled Resource Consumption\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"3.0.0\", \"versionStartIncluding\": \"0.1.0\"}], \"operator\": \"AND\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-05-09T04:18:13.116Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-32686\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-09T04:18:13.116Z\", \"dateReserved\": \"2026-03-13T09:12:14.474Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-05-07T14:04:47.222Z\", \"assignerShortName\": \"EEF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-RHV4-8758-JX7V

Vulnerability from github – Published: 2026-05-12 15:09 – Updated: 2026-05-12 15:09

Summary

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Details

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp: - add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827). - to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513). - to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605). - round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874). - compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Severity ?

6.9 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "decimal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.0"
            },
            {
              "fixed": "3.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32686"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-12T15:09:20Z",
    "nvd_published_at": "2026-05-07T15:16:05Z",
    "severity": "MODERATE"
  },
  "details": "Summary\n`decimal` doesn\u0027t bound the exponent on parsed input, so something like `\"1e10000000\"` is parsed fine but then explodes the memory to more than 7GB if you run e.g. `Decimal.add(Decimal.parse(\"1e10000000\"), 1)` because for positive `exp`, the function tail-recurses with `coef * 10` and `exp - 1` per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.\n\n### Details\n`Decimal.new/parse/cast` happily store huge exponents. After that, a bunch of core paths allocate proportional to `exp`:\n- `add/sub/div` go through `add_align`, which calls `pow10(exp1 - exp2)` and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).\n- `to_string/2` with `:normal` (also `:xsd` and the `String.Chars` impl) does `:lists.duplicate(exp, ?0)` (lib/decimal.ex:1506, 1513).\n- `to_integer/1` recurses `coef * 10`, `exp - 1` once per unit of `exp` (lib/decimal.ex:1603-1605).\n- `round/3` does the same `:lists.duplicate` trick on the exp difference (lib/decimal.ex:1850, 1874).\n- `compare/3` with a threshold argument loops back into `add`/`sub`, so it\u0027s vulnerable too (lib/decimal.ex:331-332).\n\n### PoC\nAny of these will hang or OOM the BEAM:\n```elixir\nDecimal.add(Decimal.new(\"1\"), Decimal.new(\"1e1000000000\"))\nDecimal.to_string(Decimal.new(\"1e1000000000\"), :normal)\nDecimal.to_integer(Decimal.new(\"1e1000000000\"))\nDecimal.round(Decimal.new(\"1e1000000000\"))\n```\n\n### Impact\nUnauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto `:decimal` field \u2014 basically everywhere) and then does arithmetic, rounding, `to_integer`, or `to_string` on it is exposed. One request can kill the node with a Out-of-Memory exception.",
  "id": "GHSA-rhv4-8758-jx7v",
  "modified": "2026-05-12T15:09:20Z",
  "published": "2026-05-12T15:09:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32686"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-32686.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ericmj/decimal"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ericmj/decimal/releases/tag/v3.0.0"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32686"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS"
}

FKIE_CVE-2026-32686

Vulnerability from fkie_nvd - Published: 2026-05-07 15:16 - Updated: 2026-05-08 23:16

Severity ?

6.9 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-32686.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-32686
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new(\"1e1000000000\")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2), Decimal.to_string/2 with :normal or :xsd format, Decimal.to_integer/1, Decimal.round/3, or Decimal.compare/3 with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0."
    }
  ],
  "id": "CVE-2026-32686",
  "lastModified": "2026-05-08T23:16:35.113",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-07T15:16:05.370",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-32686.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32686"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-32686 (GCVE-0-2026-32686)

GHSA-RHV4-8758-JX7V

Details

PoC

Impact

FKIE_CVE-2026-32686

Tags

Sightings

Nomenclature