CVE-2026-32686
Full vulnerability record from the local CVENow database.
Description
Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service. The decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new("1e1000000000")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM. Any application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash. This issue affects decimal: from 0.1.0 before 3.0.0.
Severity
MEDIUM
CVSS score
6.9
(v4.0)
Vulnerability status
Deferred
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-05-07 15:16:05.370000
Last modified
2026-10-26 20:10:00.160000
View original CVE JSON
{
"id": "CVE-2026-32686",
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"published": "2026-05-07T15:16:05.370",
"lastModified": "2026-10-26T20:10:00.160",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new(\"1e1000000000\")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0."
},
{
"lang": "es",
"value": "La vulnerabilidad de consumo de recursos no controlado en ericmj decimal permite la denegación de servicio remota no autenticada.\n\nLa biblioteca decimal no limita el exponente en la entrada analizada. Almacenar un decimal con un exponente muy grande (p. ej., Decimal.new(’1e1000000000’)) es aceptado sin error. Las llamadas subsiguientes a funciones aritméticas (Decimal.add/2, Decimal.sub/2, Decimal.div/2), Decimal.to_string/2 con formato :normal o :xsd, Decimal.to_integer/1, Decimal.round/3, o Decimal.compare/3 con un umbral asignan memoria proporcional al valor del exponente, lo que puede agotar la memoria disponible y bloquear la VM de BEAM.\n\nCualquier aplicación que acepte entrada decimal proporcionada por el usuario y posteriormente realice operaciones aritméticas, redondeo, conversión a entero o formato de cadena en ella está expuesta. Una única solicitud maliciosa es suficiente para causar un bloqueo por falta de memoria.\n\nEste problema afecta a decimal: desde 0.1.0 antes de 3.0.0."
}
],
"affected": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"affectedData": [
{
"vendor": "ericmj",
"product": "decimal",
"defaultStatus": "unaffected",
"collectionURL": "https://repo.hex.pm",
"packageName": "decimal",
"cpes": [
"cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
],
"modules": [
"'Elixir.Decimal'"
],
"programFiles": [
"lib/decimal.ex"
],
"programRoutines": [
{
"name": "'Elixir.Decimal':new/1"
},
{
"name": "'Elixir.Decimal':parse/1"
},
{
"name": "'Elixir.Decimal':cast/1"
},
{
"name": "'Elixir.Decimal':add/2"
},
{
"name": "'Elixir.Decimal':sub/2"
},
{
"name": "'Elixir.Decimal':div/2"
},
{
"name": "'Elixir.Decimal':to_string/2"
},
{
"name": "'Elixir.Decimal':to_integer/1"
},
{
"name": "'Elixir.Decimal':round/3"
},
{
"name": "'Elixir.Decimal':compare/3"
}
],
"repo": "https://github.com/ericmj/decimal",
"packageURL": "pkg:hex/decimal",
"versions": [
{
"version": "0.1.0",
"lessThan": "3.0.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "ericmj",
"product": "decimal",
"defaultStatus": "unaffected",
"collectionURL": "https://github.com",
"packageName": "ericmj/decimal",
"cpes": [
"cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
],
"modules": [
"'Elixir.Decimal'"
],
"programFiles": [
"lib/decimal.ex"
],
"programRoutines": [
{
"name": "'Elixir.Decimal':new/1"
},
{
"name": "'Elixir.Decimal':parse/1"
},
{
"name": "'Elixir.Decimal':cast/1"
},
{
"name": "'Elixir.Decimal':add/2"
},
{
"name": "'Elixir.Decimal':sub/2"
},
{
"name": "'Elixir.Decimal':div/2"
},
{
"name": "'Elixir.Decimal':to_string/2"
},
{
"name": "'Elixir.Decimal':to_integer/1"
},
{
"name": "'Elixir.Decimal':round/3"
},
{
"name": "'Elixir.Decimal':compare/3"
}
],
"repo": "https://github.com/ericmj/decimal",
"packageURL": "pkg:github/ericmj/decimal",
"versions": [
{
"version": "bc11f4a2b6fb61fc1360a0ab4e79141bba918841",
"lessThan": "6a523f3a73b8c9974540e21c7aa88f1258bb35ae",
"versionType": "git",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-08T22:42:13.343081Z",
"id": "CVE-2026-32686",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-400"
}
]
}
],
"references": [
{
"url": "https://cna.erlef.org/cves/CVE-2026-32686.html",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/ericmj/decimal/commit/bc11f4a2b6fb61fc1360a0ab4e79141bba918841",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-32686",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}