ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-97853

Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS

Published Oct 10, 2026 · catalog updated Oct 15, 2026 · Unbounded allocation in decimal

Check if you run it

No confirmed exploitation is on record for CVE-2026-97853. EPSS is 0.14%. Act only if a listed version of Unbounded allocation in decimal is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Unbounded allocation in decimal).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium6.9
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.14%
Remediation
Advisory link
Affected products
Hex decimal

## Summary Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the argument instead of with the size of the result. For positive it appends zero digits to the coefficient as a charlist before converting it to an integer, and for negative it builds a charlist of zero digits. A single call such as allocates about 5.5 GB of memory, which can exhaust available memory and get the BEAM VM killed. The oldest releases instead loop once per decimal place, consuming CPU in proportion to . Any application that passes a user-supplied number of decimal places or scale to or without bounding it is exposed. The input limits added for CVE-2026-32686 do not cover the argument. This issue affects decimal: from 0.1.0 before 3.1.2. ## Details sets the target exponent to and materializes the coefficient at that exponent; only applies the precision afterwards. - Positive (introduced in 1.3.0 by commit 7a83d27): followed by ( in 3.1.1). The list is built before raises for results over about 1.26 million digits, the BEAM integer size limit. - Negative (since 1.4.0): ( in 3.1.1). - Releases from 0.1.0 before 1.1.0: (and in 1.0.1 ) recurses once per decimal place for negative ; 1.0.1 also multiplies a power of ten by 10 on every iteration. Established by reading the code; these releases do not compile on current Elixir. Measured on OTP 29 with 3.1.1, one call per fresh VM: | Call | Time | Peak VM memory | |---|---|---| | | 0.25 s | 0.8 GB | | | 1.2 s | 5.5 GB | | | 2.1 s, then | 2.4 GB | In an container started with , either of the last two calls got the VM killed (exit status 137). Over HTTP (Plug and Bandit) a 34-byte JSON body carrying returned after 1.25 s with server memory at 4.3 GB. ## Proof of concept ## Impact An attacker who controls the number of decimal places an application round

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Hex decimal0.1.0 → 3.1.2

How to fix CVE-2026-97853

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-97853. EPSS is 0.14%. Act only if a listed version of Unbounded allocation in decimal is installed.

Which versions are affected?

Compare what you have installed with 0.1.0 → 3.1.2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-789. EPSS 0.14%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 10, 2026 · GitHub Advisory Database

    Fix available

    decimal fixed in 3.1.2

  2. Oct 10, 2026 · GitHub Advisory Database

    Fix available

    decimal fixed in 3.1.2

  3. Oct 10, 2026 · GitHub Advisory Database

    Updated

    ## Summary Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the argument instead of with the size of the result. For positive it appends zero digits to the coefficient as a charlist before conve

  4. Oct 13, 2026 · Tenable CVE Database

    Detected

    Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the places argument instead of with the size of the result. For positive places it appends places zero digits to the coefficient

  5. Oct 15, 2026 · NIST NVD

    Updated

    Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the places argument instead of with the size of the result. For positive places it appends places zero digits to the coefficient

Sources

  • CVE.orgVulnerability recordCVE-2026-97853

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-97853

    30-day exploitation probability 0.1%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-6c27-994x-c52f

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • NIST NVDVulnerability recordCVE-2026-97853

    Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the plac

    nvd.nist.gov
  • OpenSSF OSV / OSV ScannerPackage advisoryEEF-CVE-2026-97853

    Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS

    osv.dev
  • Tenable CVE DatabaseVulnerability recordCVE-2026-97853

    Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the places argument instead of with the size of the result. For positive places it appends places zero digits to the coefficient

    tenable.com

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.