CVE-2026-32686 Details
Description
Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service. The decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new("1e1000000000")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM. Any application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash. This issue affects decimal: from 0.1.0 before 3.0.0.
A denial-of-service vulnerability has been identified in the Ericmj Decimal library, versions 0.1.0 prior to 3.0.0. This vulnerability allows unauthenticated remote attackers to cause uncontrolled resource consumption, leading to application crashes. The issue arises because the library does not impose limits on the exponent of parsed decimal values. For instance, a value like '1e1000000000' can be stored without any errors. However, when this value is used in arithmetic operations or certain formatting functions, it allocates memory in proportion to the exponent, potentially exhausting available resources and crashing the BEAM virtual machine. Any application that processes user-supplied decimal input and performs calculations or conversions with it is vulnerable. Notably, a single malicious request can trigger this out-of-memory condition, causing the node to fail.
The vulnerability has been patched in Decimal version 3.0.0. Users should upgrade to this version to mitigate the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 7, 2026CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://cna.erlef.org/cves/CVE-2026-32686.html | EEF | AdvisoryBundleVendor |
| https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae | EEF | Source CodeVendor |
| https://github.com/ericmj/decimal/commit/bc11f4a2b6fb61fc1360a0ab4e79141bba918841 | EEF | |
| https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v | EEF | AdvisoryExploitRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-32686 | EEF | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | EEF |
Affected Products
| Product | Versions |
|---|---|
| ericmj decimal | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | EEF |
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | New CVE Received | EEF |