ericmj CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM ericmj CVE published 2026-10-10

CVE-2026-97853

A Memory Allocation with Excessive Size Value vulnerability in the ericmj decimal library can lead to Denial of Service. The vulnerability arises from the Decimal.round/3 function's handling of the places argument, which can cause excessive memory allocation. This issue affects decimal versions from 0.1.0 before 3.1.2. The vulnerability is triggered when a user-supplied number of decimal places or scale i [truncated]

MEDIUM ericmj CVE published 2026-05-07

CVE-2026-32686

CVE-2026-32686 is an Uncontrolled Resource Consumption vulnerability in the ericmj decimal library, which can lead to a Denial of Service (DoS) attack. The library does not bound the exponent on parsed input, allowing an attacker to cause an out-of-memory crash with a single malicious request. This issue affects decimal versions from 0.1.0 before 3.0.0.