Memory Allocation Vulnerability in ericmj Decimal Library

CVE-2026-97853

What is CVE-2026-97853?

A memory allocation vulnerability exists in the ericmj Decimal library, where the Decimal.round/3 function allows an attacker to specify an excessively large number of decimal places. This leads to dramatic memory consumption, causing Denial of Service (DoS) as it can allocate massive amounts of memory, potentially exhausting system resources. Applications that do not impose limits on user-supplied inputs for the places argument are particularly at risk. The library’s behavior can lead to substantial performance degradation or complete failure of the BEAM VM, making it imperative for developers to implement input validations.

References