Uncontrolled Resource Consumption in Decimal Library by Ericmj

CVE-2026-32686

What is CVE-2026-32686?

The Decimal library by Ericmj is affected by a vulnerability that allows unauthenticated remote Denial of Service due to uncontrolled resource consumption. Specifically, the library does not impose limits on the exponent in parsed decimal input. This enables the storage of exceedingly large exponents without any error feedback (e.g., Decimal.new("1e1000000000")). When arithmetic operations or conversions are subsequently performed using this unbounded input, memory allocation occurs in proportion to the exponent value. Consequently, this can result in exhausting available memory, potentially crashing the BEAM virtual machine. Applications enabling user-provided decimal input that performs arithmetic operations, rounding, conversion, or string formatting are particularly vulnerable, as a single malicious request can lead to an out-of-memory condition.

References