Is CVE-2026-32686 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32686 being exploited in the wild.

How severe is CVE-2026-32686?

Medium severity, with a CVSS score of 6.9, published 7 May 2026.

Which products and versions are affected?

Erlang Decimal >= 0.1.0, < 3.0.0.

Is there a fix for CVE-2026-32686?

A patch was published on 2026-05-07: Initial patch in 3.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32686 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-32686?

Check whether you run Erlang Decimal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32686: ericmj decimal denial of service via unbounded exponent

Q: Is there a fix for CVE-2026-32686?

A patch was published on 2026-05-07: Initial patch in 3.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-32686 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-32686?

Check whether you run Erlang Decimal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32686 · Severity: medium · CVSS 6.9 · Published 2026-05-07

A vulnerability in the 'decimal' library, commonly used in Elixir and Erlang applications to handle precise math, allows an attacker to crash a server. By providing a specially crafted number with an extremely large exponent, an attacker can force the application to consume all available memory. This results in a denial-of-service (DoS) where the application becomes unresponsive or shuts down entirely.

Vendors: Erlang.

Quick answers

Is CVE-2026-32686 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32686 being exploited in the wild.
How severe is CVE-2026-32686?: Medium severity, with a CVSS score of 6.9, published 7 May 2026.
Which products and versions are affected?: Erlang Decimal >= 0.1.0, < 3.0.0.
Is there a fix for CVE-2026-32686?: A patch was published on 2026-05-07: Initial patch in 3.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32686 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-32686?: Check whether you run Erlang Decimal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The 'decimal' library does not bound the exponent on parsed input in functions like `Decimal.new/parse/cast`. When arithmetic operations (add, sub, div), rounding, or string conversions are performed on these decimals, the library uses tail-recursion or list duplication proportional to the exponent's value. For example, a positive exponent causes the library to grow a bignum coefficient by one digit per iteration, rapidly exhausting memory. An unauthenticated remote attacker can exploit this by submitting a large exponent (e.g., "1e10000000") via JSON, form fields, or database entries that the application subsequently processes. This vulnerability is fully patched in version 3.0.0; while version 2.4.0 contains mitigations, they are not enabled by default.

Affected products

ericmj decimal >= 0.1.0, < 3.0.0

Identifiers

CVE-2026-32686
GHSA-rhv4-8758-jx7v

Timeline

2026-05-07: disclosed
2026-05-07: patched: Initial patch in 3.0.0
2026-05-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.