CVSS 4.0
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се локално, без особени условия, без вход и без действие от потребителя.
- Експлоатация: има публичен пример за експлоатация
- Атаката може да се автоматизира
Описание
Оригинално описание
Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service. The decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new("1e1000000000")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM. Any application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash. This issue affects decimal: from 0.1.0 before 3.0.0.
Засегнати продукти
- ericmj decimal: 0.1.0 преди 3.0.0
- ericmj decimal: bc11f4a2b6fb61fc1360a0ab4e79141bba918841 преди 6a523f3a73b8c9974540e21c7aa88f1258bb35ae
Вид слабост
История
- 7 май 2026 Публикувано
Други уязвимости в ericmj decimal
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-32686
- https://nvd.nist.gov/vuln/detail/CVE-2026-32686
- https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v
- https://cna.erlef.org/cves/CVE-2026-32686.html
- https://osv.dev/vulnerability/EEF-CVE-2026-32686
- https://github.com/ericmj/decimal/commit/bc11f4a2b6fb61fc1360a0ab4e79141bba918841
- https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae