CVE-2026-32686

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32686", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-03-13T09:12:14.474Z", "datePublished": "2026-05-07T14:04:47.222Z", "dateUpdated": "2026-09-08T13:08:41.575Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Decimal'"], "packageName": "decimal", "packageURL": "pkg:hex/decimal", "product": "decimal", "programFiles": ["lib/decimal.ex"], "programRoutines": [{"name": "'Elixir.Decimal':new/1"}, {"name": "'Elixir.Decimal':parse/1"}, {"name": "'Elixir.Decimal':cast/1"}, {"name": "'Elixir.Decimal':add/2"}, {"name": "'Elixir.Decimal':sub/2"}, {"name": "'Elixir.Decimal':div/2"}, {"name": "'Elixir.Decimal':to_string/2"}, {"name": "'Elixir.Decimal':to_integer/1"}, {"name": "'Elixir.Decimal':round/3"}, {"name": "'Elixir.Decimal':compare/3"}], "repo": "https://github.com/ericmj/decimal", "vendor": "ericmj", "versions": [{"lessThan": "3.0.0", "status": "affected", "version": "0.1.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Decimal'"], "packageName": "ericmj/decimal", "packageURL": "pkg:github/ericmj/decimal", "product": "decimal", "programFiles": ["lib/decimal.ex"], "programRoutines": [{"name": "'Elixir.Decimal':new/1"}, {"name": "'Elixir.Decimal':parse/1"}, {"name": "'Elixir.Decimal':cast/1"}, {"name": "'Elixir.Decimal':add/2"}, {"name": "'Elixir.Decimal':sub/2"}, {"name": "'Elixir.Decimal':div/2"}, {"name": "'Elixir.Decimal':to_string/2"}, {"name": "'Elixir.Decimal':to_integer/1"}, {"name": "'Elixir.Decimal':round/3"}, {"name": "'Elixir.Decimal':compare/3"}], "repo": "https://github.com/ericmj/decimal", "vendor": "ericmj", "versions": [{"lessThan": "6a523f3a73b8c9974540e21c7aa88f1258bb35ae", "status": "affected", "version": "bc11f4a2b6fb61fc1360a0ab4e79141bba918841", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.0.0", "versionStartIncluding": "0.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Eric Meadows-J\u00f6nsson / Hex.pm"}, {"lang": "en", "type": "remediation reviewer", "value": "Jos\u00e9 Valim"}, {"lang": "en", "type": "remediation reviewer", "value": "Wojtek Mach"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}, {"lang": "en", "type": "remediation reviewer", "value": "ruslandoga"}, {"lang": "en", "type": "remediation reviewer", "value": "Matthew Johnston"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.</p>\n<p>The <code>decimal</code> library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. <code>Decimal.new(\"1e1000000000\")</code>) is accepted without error. Subsequent calls to arithmetic functions (<code>Decimal.add/2</code>, <code>Decimal.sub/2</code>, <code>Decimal.div/2</code>M), <code>Decimal.to_string/2</code>M with <code>:normal</code>M or <code>:xsd</code>M format, <code>Decimal.to_integer/1</code>M, <code>Decimal.round/3</code>M, or <code>Decimal.compare/3</code>M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.</p>\n<p>Any application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.</p>\n<p>This issue affects decimal: from 0.1.0 before 3.0.0.</p>"}, {"base64": false, "type": "text/markdown", "value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe `decimal` library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. `Decimal.new(\"1e1000000000\")`) is accepted without error. Subsequent calls to arithmetic functions (`Decimal.add/2`, `Decimal.sub/2`, `Decimal.div/2`M), `Decimal.to_string/2`M with `:normal`M or `:xsd`M format, `Decimal.to_integer/1`M, `Decimal.round/3`M, or `Decimal.compare/3`M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0."}], "value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new(\"1e1000000000\")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0."}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-08T13:08:41.575Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"}, {"name": "EEF CNA record for CVE-2026-32686", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-32686.html"}, {"name": "OSV record EEF-CVE-2026-32686", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32686"}, {"name": "Introducing commit bc11f4a in ericmj/decimal", "tags": ["related"], "url": "https://github.com/ericmj/decimal/commit/bc11f4a2b6fb61fc1360a0ab4e79141bba918841"}, {"name": "Fix commit 6a523f3 in ericmj/decimal", "tags": ["patch"], "url": "https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae"}], "source": {"discovery": "EXTERNAL"}, "title": "Unbounded exponent in decimal enables unauthenticated DoS"}, "adp": [{"references": [{"url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-08T22:42:13.343081Z", "id": "CVE-2026-32686", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T22:43:03.396Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32686", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-08T22:42:13.343081Z"}}}], "references": [{"url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T22:42:55.384Z"}}], "cna": {"title": "Unbounded exponent in decimal enables unauthenticated DoS", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Eric Meadows-J\u00f6nsson / Hex.pm"}, {"lang": "en", "type": "remediation reviewer", "value": "Jos\u00e9 Valim"}, {"lang": "en", "type": "remediation reviewer", "value": "Wojtek Mach"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}, {"lang": "en", "type": "remediation reviewer", "value": "ruslandoga"}, {"lang": "en", "type": "remediation reviewer", "value": "Matthew Johnston"}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"], "repo": "https://github.com/ericmj/decimal", "vendor": "ericmj", "modules": ["'Elixir.Decimal'"], "product": "decimal", "versions": [{"status": "affected", "version": "0.1.0", "lessThan": "3.0.0", "versionType": "semver"}], "packageURL": "pkg:hex/decimal", "packageName": "decimal", "programFiles": ["lib/decimal.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Decimal':new/1"}, {"name": "'Elixir.Decimal':parse/1"}, {"name": "'Elixir.Decimal':cast/1"}, {"name": "'Elixir.Decimal':add/2"}, {"name": "'Elixir.Decimal':sub/2"}, {"name": "'Elixir.Decimal':div/2"}, {"name": "'Elixir.Decimal':to_string/2"}, {"name": "'Elixir.Decimal':to_integer/1"}, {"name": "'Elixir.Decimal':round/3"}, {"name": "'Elixir.Decimal':compare/3"}]}, {"cpes": ["cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"], "repo": "https://github.com/ericmj/decimal", "vendor": "ericmj", "modules": ["'Elixir.Decimal'"], "product": "decimal", "versions": [{"status": "affected", "version": "bc11f4a2b6fb61fc1360a0ab4e79141bba918841", "lessThan": "6a523f3a73b8c9974540e21c7aa88f1258bb35ae", "versionType": "git"}], "packageURL": "pkg:github/ericmj/decimal", "packageName": "ericmj/decimal", "programFiles": ["lib/decimal.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Decimal':new/1"}, {"name": "'Elixir.Decimal':parse/1"}, {"name": "'Elixir.Decimal':cast/1"}, {"name": "'Elixir.Decimal':add/2"}, {"name": "'Elixir.Decimal':sub/2"}, {"name": "'Elixir.Decimal':div/2"}, {"name": "'Elixir.Decimal':to_string/2"}, {"name": "'Elixir.Decimal':to_integer/1"}, {"name": "'Elixir.Decimal':round/3"}, {"name": "'Elixir.Decimal':compare/3"}]}], "references": [{"url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-32686.html", "name": "EEF CNA record for CVE-2026-32686", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-32686", "name": "OSV record EEF-CVE-2026-32686", "tags": ["related"]}, {"url": "https://github.com/ericmj/decimal/commit/bc11f4a2b6fb61fc1360a0ab4e79141bba918841", "name": "Introducing commit bc11f4a in ericmj/decimal", "tags": ["related"]}, {"url": "https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae", "name": "Fix commit 6a523f3 in ericmj/decimal", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new(\"1e1000000000\")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0.", "supportingMedia": [{"type": "text/html", "value": "<p>Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.</p>\n<p>The <code>decimal</code> library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. <code>Decimal.new(\"1e1000000000\")</code>) is accepted without error. Subsequent calls to arithmetic functions (<code>Decimal.add/2</code>, <code>Decimal.sub/2</code>, <code>Decimal.div/2</code>M), <code>Decimal.to_string/2</code>M with <code>:normal</code>M or <code>:xsd</code>M format, <code>Decimal.to_integer/1</code>M, <code>Decimal.round/3</code>M, or <code>Decimal.compare/3</code>M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.</p>\n<p>Any application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.</p>\n<p>This issue affects decimal: from 0.1.0 before 3.0.0.</p>", "base64": false}, {"type": "text/markdown", "value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe `decimal` library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. `Decimal.new(\"1e1000000000\")`) is accepted without error. Subsequent calls to arithmetic functions (`Decimal.add/2`, `Decimal.sub/2`, `Decimal.div/2`M), `Decimal.to_string/2`M with `:normal`M or `:xsd`M format, `Decimal.to_integer/1`M, `Decimal.round/3`M, or `Decimal.compare/3`M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.0.0", "versionStartIncluding": "0.1.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-08T13:08:41.575Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32686", "state": "PUBLISHED", "dateUpdated": "2026-09-08T13:08:41.575Z", "dateReserved": "2026-03-13T09:12:14.474Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-05-07T14:04:47.222Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Decimal'"], "packageName": "decimal", "packageURL": "pkg:hex/decimal", "product": "decimal", "programFiles": ["lib/decimal.ex"], "programRoutines": [{"name": "'Elixir.Decimal':new/1"}, {"name": "'Elixir.Decimal':parse/1"}, {"name": "'Elixir.Decimal':cast/1"}, {"name": "'Elixir.Decimal':add/2"}, {"name": "'Elixir.Decimal':sub/2"}, {"name": "'Elixir.Decimal':div/2"}, {"name": "'Elixir.Decimal':to_string/2"}, {"name": "'Elixir.Decimal':to_integer/1"}, {"name": "'Elixir.Decimal':round/3"}, {"name": "'Elixir.Decimal':compare/3"}], "repo": "https://github.com/ericmj/decimal", "vendor": "ericmj", "versions": [{"lessThan": "3.0.0", "status": "affected", "version": "0.1.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Decimal'"], "packageName": "ericmj/decimal", "packageURL": "pkg:github/ericmj/decimal", "product": "decimal", "programFiles": ["lib/decimal.ex"], "programRoutines": [{"name": "'Elixir.Decimal':new/1"}, {"name": "'Elixir.Decimal':parse/1"}, {"name": "'Elixir.Decimal':cast/1"}, {"name": "'Elixir.Decimal':add/2"}, {"name": "'Elixir.Decimal':sub/2"}, {"name": "'Elixir.Decimal':div/2"}, {"name": "'Elixir.Decimal':to_string/2"}, {"name": "'Elixir.Decimal':to_integer/1"}, {"name": "'Elixir.Decimal':round/3"}, {"name": "'Elixir.Decimal':compare/3"}], "repo": "https://github.com/ericmj/decimal", "vendor": "ericmj", "versions": [{"lessThan": "6a523f3a73b8c9974540e21c7aa88f1258bb35ae", "status": "affected", "version": "bc11f4a2b6fb61fc1360a0ab4e79141bba918841", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new(\"1e1000000000\")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0."}, {"lang": "es", "value": "La vulnerabilidad de consumo de recursos no controlado en ericmj decimal permite la denegaci\u00f3n de servicio remota no autenticada.\n\nLa biblioteca decimal no limita el exponente en la entrada analizada. Almacenar un decimal con un exponente muy grande (p. ej., Decimal.new(\u20191e1000000000\u2019)) es aceptado sin error. Las llamadas subsiguientes a funciones aritm\u00e9ticas (Decimal.add/2, Decimal.sub/2, Decimal.div/2), Decimal.to_string/2 con formato :normal o :xsd, Decimal.to_integer/1, Decimal.round/3, o Decimal.compare/3 con un umbral asignan memoria proporcional al valor del exponente, lo que puede agotar la memoria disponible y bloquear la VM de BEAM.\n\nCualquier aplicaci\u00f3n que acepte entrada decimal proporcionada por el usuario y posteriormente realice operaciones aritm\u00e9ticas, redondeo, conversi\u00f3n a entero o formato de cadena en ella est\u00e1 expuesta. Una \u00fanica solicitud maliciosa es suficiente para causar un bloqueo por falta de memoria.\n\nEste problema afecta a decimal: desde 0.1.0 antes de 3.0.0."}], "id": "CVE-2026-32686", "lastModified": "2026-10-26T20:10:00.160", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32686", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-08T22:42:13.343081Z", "version": "2.0.3"}}]}, "published": "2026-05-07T15:16:05.370", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-32686.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/ericmj/decimal/commit/bc11f4a2b6fb61fc1360a0ab4e79141bba918841"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32686"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.1.0,3.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "decimal", "source": "cna", "vendor": "ericmj"}, "product": "decimal", "vendor": "ericmj"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bc11f4a2b6fb61fc1360a0ab4e79141bba918841,6a523f3a73b8c9974540e21c7aa88f1258bb35ae)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "decimal", "source": "cna", "vendor": "ericmj"}, "product": "decimal", "vendor": "ericmj"}], "created": "2026-05-07T15:45:32.481617+00:00", "updated": "2026-09-08T15:30:18.246861+00:00", "vendors": ["ericmj", "ericmj$PRODUCT$decimal"]}