Most recent entries from all

EUVD-2026-364978

fkie_cve-2026-32686

Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.

The decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new("1e1000000000")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.

Any application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.

This issue affects decimal: from 0.1.0 before 3.0.0.

GHSA-rhv4-8758-jx7v — Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Affected: Hex: decimal

Summary `decimal` doesn't bound the exponent on parsed input, so something like `"1e10000000"` is parsed fine but then explodes the memory to more than 7GB if you run e.g. `Decimal.add(Decimal.parse("1e10000000"), 1)` because for positive `exp`, the function tail-recurses with `coef * 10` and `exp - 1` per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

### Details `Decimal.new/parse/cast` happily store huge exponents. After that, a bunch of core paths allocate proportional to `exp`: - `add/sub/div` go through `add_align`, which calls `pow10(exp1 - exp2)` and builds a giant bignum (lib/decimal.ex:1734-1738, 1827). - `to_string/2` with `:normal` (also `:xsd` and the `String.Chars` impl) does `:lists.duplicate(exp, ?0)` (lib/decimal.ex:1506, 1513). - `to_integer/1` recurses `coef * 10`, `exp - 1` once per unit of `exp` (lib/decimal.ex:1603-1605). - `round/3` does the same `:lists.duplicate` trick on the exp difference (lib/decimal.ex:1850, 1874). - `compare/3` with a threshold argument loops back into `add`/`sub`, so it's vulnerable too (lib/decimal.ex:331-332).

### PoC Any of these will hang or OOM the BEAM: ```elixir Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000")) Decimal.to_string(Decimal.new("1e1000000000"), :normal) Decimal.to_integer(Decimal.new("1e1000000000")) Decimal.round(Decimal.new("1e1000000000")) ```

### Impact Unauthenticated remote DoS. Anything that takes a user-supplied…