Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-97853— Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS

Quick assessment

Affected
ericmj decimal
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

库中存在一个“分配过大内存值”（Excessive Size Value）漏洞，可导致拒绝服务（Denial of Service, DoS）。 在 函数中，系统会在应用上下文精度（默认为 34 位）之前，先为请求的十进制位数构建完整的计算结果，因此其资源消耗随 （位数）参数增长，而非随结果的大小增长。具体而言： 当 为正数时，函数会先将相应数量的零作为字符列表附加到系数末尾，再转换为整数； 当 为负数时，函数会构建一个由 个零组成的字符列表。 例如，单次调用 就会分配约 5.5 GB 的内存，这可能导致可用内存耗

CVSS 6.9 · Medium EPSS 0.14% · P3

Affected Version Matrix 2

VendorProduct Version RangeStatus
ericmj decimal 0.1.0< 3.1.2 affected
05bb73eb40ddef24eda782d905766f56a3660522< * affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-97853

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS
Source: CVE Program / CVE List V5
Vulnerability Description
Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the places argument instead of with the size of the result. For positive places it appends places zero digits to the coefficient as a charlist before converting it to an integer, and for negative places it builds a charlist of -places zero digits. A single call such as Decimal.round(Decimal.new("1.5"), -50_000_000) allocates about 5.5 GB of memory, which can exhaust available memory and get the BEAM VM killed. The oldest releases instead loop once per decimal place, consuming CPU in proportion to places. Any application that passes a user-supplied number of decimal places or scale to Decimal.round/2 or Decimal.round/3 without bounding it is exposed. The input limits added for CVE-2026-32686 do not cover the places argument. This issue affects decimal: from 0.1.0 before 3.1.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的内存分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ericmj decimal 0.1.0 ~ 3.1.2 cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*
ericmj decimal 05bb73eb40ddef24eda782d905766f56a3660522 ~ * cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-97853

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-97853

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-97853 (2)

Vendor Advisories for CVE-2026-97853 (3)

IV. Related Vulnerabilities

Same product: decimal
Same vendor: ericmj
Same weakness: CWE-789

V. Comments for CVE-2026-97853

No comments yet

Leave a comment