CVE-2026-32686— Unbounded exponent in decimal enables unauthenticated DoS

Unbounded exponent in decimal enables unauthenticated DoS

Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service. The decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new("1e1000000000")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2), Decimal.to_string/2 with :normal or :xsd format, Decimal.to_integer/1, Decimal.round/3, or Decimal.compare/3 with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM. Any application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash. This issue affects decimal: from 0.1.0 before 3.0.0.

N/A

未加控制的资源消耗(资源穷尽)

Decimal 资源管理错误漏洞

Decimal是Eric Meadows-Jönsson个人开发者的一个任意精度十进制算术库。 Decimal 0.1.0版本至3.0.0之前版本存在资源管理错误漏洞，该漏洞源于未限制解析输入的指数，可能导致未经身份验证的远程拒绝服务攻击，通过存储具有极大指数的十进制数并在后续算术、格式化或比较操作中分配与指数值成比例的内存，从而耗尽内存并导致BEAM VM崩溃。

N/A

N/A