https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 16:11:16 +0000 https://cve.radiocsirt.org/vuln/cve-2026-32686 <p><strong>Affected:</strong> ericmj decimal</p> <p>Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.</p> <p>The decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new(&#34;1e1000000000&#34;)) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.</p> <p>Any application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.</p> <p>This issue affects decimal: from 0.1.0 before 3.0.0.</p> <p><strong>Affected:</strong> ericmj decimal</p> <p>Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.</p> <p>The decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new(&#34;1e1000000000&#34;)) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.</p> <p>Any application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.</p> <p>This issue affects decimal: from 0.1.0 before 3.0.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-32686