CVE-2026-97853 Details
Description
Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the places argument instead of with the size of the result. For positive places it appends places zero digits to the coefficient as a charlist before converting it to an integer, and for negative places it builds a charlist of -places zero digits. A single call such as Decimal.round(Decimal.new("1.5"), -50_000_000) allocates about 5.5 GB of memory, which can exhaust available memory and get the BEAM VM killed. The oldest releases instead loop once per decimal place, consuming CPU in proportion to places. Any application that passes a user-supplied number of decimal places or scale to Decimal.round/2 or Decimal.round/3 without bounding it is exposed. The input limits added for CVE-2026-32686 do not cover the places argument. This issue affects decimal: from 0.1.0 before 3.1.2.
A memory allocation vulnerability has been identified in the Ericmj Decimal library, specifically in versions 0.1.0 prior to 3.1.2. The issue arises in the Decimal.round/3 function, which allocates memory based on the 'places' argument without proper bounds. This unbounded allocation can lead to excessive memory use, causing the BEAM virtual machine to crash. For instance, rounding a number to -50 million places can consume approximately 5.5 GB of memory, exhausting available resources and terminating the VM. Although the latest release (3.1.2) addresses this vulnerability, applications that pass user-supplied values for decimal places to Decimal.round/2 or Decimal.round/3 without proper validation remain exposed.
Users can upgrade to Decimal version 3.1.2, which fixes the vulnerability by bounding the 'places' argument and preventing excessive memory allocation. For applications that cannot be immediately upgraded, a temporary workaround is to validate and limit the 'places' argument before calling Decimal.round/2 or Decimal.round/3.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 10, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-97853.html | EEF | AdvisoryExploit |
| https://github.com/ericmj/decimal/commit/05bb73eb40ddef24eda782d905766f56a3660522 | EEF | Source CodeVendor |
| https://github.com/ericmj/decimal/commit/338f42c8cf6a9749ab70c5af04734c6050ca3dc6 | EEF | Source CodeVendor |
| https://github.com/ericmj/decimal/commit/3c90af4c3c2dfa4bb4c138760a326dd0eb91822b | EEF | Source CodeVendor |
| https://github.com/ericmj/decimal/security/advisories/GHSA-6c27-994x-c52f | EEF | AdvisoryExploitRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-97853 | EEF | AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-789 | Memory Allocation with Excessive Size Value | EEF |
Affected Products
| Product | Versions |
|---|---|
| ericmj decimal | >= 0.1.0, < 3.1.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 10, 2026 | New CVE Received | EEF |