PT-2026-38441 · Hexpm · Decimal

Eric Meadows-Jönsson + 6 · Published 2026-04-25 · Updated 2026-05-12 · CVE-2026-32686

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ericmj decimal versions 0.1.0 through 2.x

Description Uncontrolled Resource Consumption allows unauthenticated remote Denial of Service. The library does not bound the exponent on parsed input, meaning a decimal with an excessively large exponent can be stored without error. Subsequent calls to functions such as Decimal.add/2, Decimal.sub/2, Decimal.div/2, Decimal.to integer/1, Decimal.round/3, Decimal.compare/3 with a threshold, or Decimal.to string/2 using :normal or :xsd formats allocate memory proportional to the exponent value. This can exhaust available memory and crash the BEAM VM (the Erlang Virtual Machine). Any application accepting user-supplied decimal input for arithmetic, rounding, integer conversion, or string formatting is exposed, as a single malicious request can cause an out-of-memory crash.

Recommendations Update to version 3.0.0 or later.

Exploit

Fix

DoS

Resource Exhaustion

Argument Injection

Weakness Enumeration

CWE-400

CWE-88

Related Identifiers

CVE-2026-32686

GHSA-RHV4-8758-JX7V

GHSA-X2QX-6953-8485

Affected Products

Decimal

References · 16

• 🔥 https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v · Exploit
• https://github.com/ericmj/decimal/commit/6a523f3a73b8c9974540e21c7aa88f1258bb35ae · Patch
• https://osv.dev/vulnerability/EEF-CVE-2026-32686 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rhv4-8758-jx7v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42284 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32686 · Security Note
• https://osv.dev/vulnerability/GHSA-x2qx-6953-8485 · Vendor Advisory
• https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47 · Note
• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485 · Note
• https://github.com/gitpython-developers/GitPython · Note
• https://github.com/ericmj/decimal/releases/tag/v3.0.0 · Note
• https://github.com/ericmj/decimal · Note
• https://t.me/cveNotify/162824 · Telegram Post
• https://tenable.com/cve/CVE-2026-32686 · Note
• https://cna.erlef.org/cves/CVE-2026-32686.html · Note