CVE-2026-32686 ericmj CVE debrief

Who should care

Defenders of applications that use the ericmj decimal library and accept user-supplied decimal input should assess exposure and prioritize patching or mitigating this vulnerability.

Why it matters

CVE-2026-32686 is an Uncontrolled Resource Consumption vulnerability in the ericmj decimal library, which can lead to a Denial of Service (DoS) attack. Defenders of applications that use this library and accept user-supplied decimal input should assess exposure and prioritize patching or mitigating this vulnerability.

• Potential Denial of Service (DoS) attacks
• Excessive memory usage and crashes
• Verification of affected versions and systems required

Technical summary

The decimal library does not bound the exponent on parsed input, allowing an attacker to store a decimal with a very large exponent. This can exhaust available memory and crash the BEAM VM when subsequent arithmetic functions, rounding, conversion to integer, or string formatting are performed. Any application that accepts user-supplied decimal input and subsequently performs these operations is exposed to a Denial of Service (DoS) attack. A single malicious request is sufficient to cause an out-of-memory crash. Defenders should prioritize patching or mitigating this vulnerability, especially in applications that accept user-supplied decimal input.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in applications that accept user-supplied decimal input.

Recommended defensive actions

• Patch or upgrade to a fixed version of the decimal library (version 3.0.0 or later)
• Implement input validation and sanitization for user-supplied decimal input
• Monitor applications for excessive memory usage and crashes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability. Verification of affected versions and systems is required from official sources to determine the exact scope. Defenders should verify the decimal library version used in their applications and check for any user-supplied decimal input that could be exploited. The lack of bounding on the exponent in the decimal library allows for potential Denial of Service (DoS) attacks through excessive memory usage.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.