CVE-2026-97853 ericmj CVE debrief

Who should care

Defenders responsible for maintaining applications that use the ericmj decimal library, particularly those that pass user-supplied numbers of decimal places or scales to Decimal.round/2 or Decimal.round/3, should assess their exposure and take steps to prevent potential Denial of Service attacks.

Why it matters

Defenders should prioritize verifying and updating to version 3.1.2 or later of the decimal library to prevent potential Denial of Service attacks. Applications that pass user-supplied numbers of decimal places or scales to Decimal.round/2 or Decimal.round/3 without bounding them are exposed. The input limits added for CVE-2026-32686 do not cover the places argument.

• Denial of Service due to excessive memory allocation
• Potential for BEAM VM to be killed

Technical summary

The Decimal.round/3 function in the ericmj decimal library builds the full result for the requested number of decimal places before applying context precision, leading to excessive memory allocation. A single call with a large number of decimal places can allocate significant memory, potentially exhausting available memory and causing the BEAM VM to be killed. The input limits added for CVE-2026-32686 do not cover the places argument, making applications that pass user-supplied numbers of decimal places or scales to Decimal.round/2 or Decimal.round/3 without bounding them exposed.

Defensive priority

Defenders should prioritize verifying and updating to version 3.1.2 or later of the decimal library to prevent potential Denial of Service attacks.

Recommended defensive actions

• Verify the version of the decimal library in use and update to version 3.1.2 or later if necessary.
• Review application code to ensure that user-supplied numbers of decimal places or scales are bounded before being passed to Decimal.round/2 or Decimal.round/3.
• Implement input validation and sanitization to prevent excessive memory allocation.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source references provide details on the vulnerability, including its impact on the ericmj decimal library and potential Denial of Service attacks. The vulnerability is caused by the Decimal.round/3 function's handling of the places argument, which can lead to excessive memory allocation. The input limits added for CVE-2026-32686 do not cover the places argument, making applications that pass user-supplied numbers of decimal places or scales to Decimal.round/2 or Decimal.round/3 without bounding them exposed. Defend

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.