ericmj decimal up to 2.x resource consumption

Summaryinfo

A vulnerability, which was classified as problematic, was found in ericmj decimal up to 2.x. This issue affects some unknown processing. The manipulation results in resource consumption. This vulnerability is known as CVE-2026-32686. Attacking locally is a requirement. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in ericmj decimal up to 2.x. It has been classified as problematic. Affected is some unknown functionality. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. CVE summarizes:

Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service. The decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new("1e1000000000")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2), Decimal.to_string/2 with :normal or :xsd format, Decimal.to_integer/1, Decimal.round/3, or Decimal.compare/3 with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM. Any application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash. This issue affects decimal: from 0.1.0 before 3.0.0.

The weakness was published by Peter Ullrich and Jonatan Männchen. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-32686 since 03/13/2026. The exploitability is told to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available.

Upgrading to version 3.0.0 eliminates this vulnerability. Applying the patch 6a523f3a73b8c9974540e21c7aa88f1258bb35ae is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• ericmj

Name

• decimal

Version

• 2.x

Website

• Product: https://github.com/ericmj/decimal/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion