Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-32686— Unbounded exponent in decimal enables unauthenticated DoS

Quick assessment

Affected
ericmj decimal
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Decimal是Eric Meadows-Jönsson个人开发者的一个任意精度十进制算术库。 Decimal 0.1.0版本至3.0.0之前版本存在资源管理错误漏洞，该漏洞源于未限制解析输入的指数，可能导致未经身份验证的远程拒绝服务攻击，通过存储具有极大指数的十进制数并在后续算术、格式化或比较操作中分配与指数值成比例的内存，从而耗尽内存并导致BEAM VM崩溃。

CVSS 6.9 · Medium EPSS 0.34% · P25

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 2

VendorProduct Version RangeStatus
ericmj decimal 0.1.0< 3.0.0 affected
bc11f4a2b6fb61fc1360a0ab4e79141bba918841< 6a523f3a73b8c9974540e21c7aa88f1258bb35ae affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-32686

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unbounded exponent in decimal enables unauthenticated DoS
Source: CVE Program / CVE List V5
Vulnerability Description
Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service. The decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new("1e1000000000")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM. Any application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash. This issue affects decimal: from 0.1.0 before 3.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
Decimal 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Decimal是Eric Meadows-Jönsson个人开发者的一个任意精度十进制算术库。 Decimal 0.1.0版本至3.0.0之前版本存在资源管理错误漏洞，该漏洞源于未限制解析输入的指数，可能导致未经身份验证的远程拒绝服务攻击，通过存储具有极大指数的十进制数并在后续算术、格式化或比较操作中分配与指数值成比例的内存，从而耗尽内存并导致BEAM VM崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
ericmj decimal 0.1.0 ~ 3.0.0 cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*
ericmj decimal bc11f4a2b6fb61fc1360a0ab4e79141bba918841 ~ 6a523f3a73b8c9974540e21c7aa88f1258bb35ae cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-32686

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-32686

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-32686 (1)

Vendor Advisories for CVE-2026-32686 (3)

IV. Related Vulnerabilities

Same product: decimal
Same vendor: ericmj
Same weakness: CWE-400

V. Comments for CVE-2026-32686

No comments yet

Leave a comment