Executive brief
A vulnerability in the 'decimal' library, commonly used in Elixir and Erlang applications to handle precise math, allows an attacker to crash a server. By providing a specially crafted number with an extremely large exponent, an attacker can force the application to consume all available memory. This results in a denial-of-service (DoS) where the application becomes unresponsive or shuts down entirely.
Technical details
The 'decimal' library does not bound the exponent on parsed input in functions like `Decimal.new/parse/cast`. When arithmetic operations (add, sub, div), rounding, or string conversions are performed on these decimals, the library uses tail-recursion or list duplication proportional to the exponent's value. For example, a positive exponent causes the library to grow a bignum coefficient by one digit per iteration, rapidly exhausting memory. An unauthenticated remote attacker can exploit this by submitting a large exponent (e.g., "1e10000000") via JSON, form fields, or database entries that the application subsequently processes. This vulnerability is fully patched in version 3.0.0; while version 2.4.0 contains mitigations, they are not enabled by default.
Affected products
- ericmj decimal >= 0.1.0, < 3.0.0
Timeline
- 2026-05-07: disclosed
- 2026-05-07: patched: Initial patch in 3.0.0
- 2026-05-12: advisory