decimal

Version	Released
`3.1.1` patch	May 27, 2026
`2.4.1` patch 1 CVE	May 08, 2026
`3.1.0` minor	May 08, 2026
`3.0.0` major	May 07, 2026
`2.4.0` minor 1 CVE	May 07, 2026
`2.3.0` minor 1 CVE	Dec 13, 2024
`2.2.0` minor 1 CVE	Nov 13, 2024
`2.1.1` patch 1 CVE	Apr 26, 2023
`2.1.0` minor 1 CVE	Apr 26, 2023
`2.0.0` major 1 CVE	Sep 08, 2020
`1.9.0` minor 1 CVE	Sep 08, 2020
`2.0.0-rc.0` pre 1 CVE	Jan 21, 2020
`1.9.0-rc.0` pre 1 CVE	Jan 07, 2020
`1.8.1` patch 1 CVE	Dec 20, 2019
`1.8.0` minor 1 CVE	Jun 24, 2019
`1.7.0` minor 1 CVE	Feb 16, 2019
`1.6.0` minor 1 CVE	Nov 22, 2018
`1.5.0` minor 1 CVE	Mar 24, 2018
`1.4.1` patch 1 CVE	Oct 12, 2017
`1.4.0` minor 1 CVE	Jun 25, 2017
`1.3.1` patch 1 CVE	Nov 11, 2016
`1.3.0` minor 1 CVE	Nov 10, 2016
`1.2.0` minor 1 CVE	Sep 26, 2016
`1.1.2` patch 1 CVE	Apr 24, 2016
`1.1.1` patch 1 CVE	Dec 26, 2015
`1.1.0` minor 1 CVE	Dec 31, 2014
`1.0.1` patch 1 CVE	Dec 16, 2014
`1.0.0` major 1 CVE	Dec 09, 2014
`0.2.5` patch 1 CVE	Sep 09, 2014
`0.2.4` patch 1 CVE	Aug 03, 2014
`0.2.3` patch 1 CVE	Jul 13, 2014
`0.2.2` patch 1 CVE	Jun 18, 2014
`0.2.1` patch 1 CVE	May 24, 2014
`0.2.0` minor 1 CVE	May 01, 2014
`0.1.2` patch 1 CVE	Apr 21, 2014
`0.1.1` initial 1 CVE	Apr 21, 2014

3.1.1 patch

May 27, 2026

2.4.1 patch

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

May 08, 2026

3.1.0 minor

May 08, 2026

3.0.0 major

May 07, 2026

2.4.0 minor

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

May 07, 2026

2.3.0 minor

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Dec 13, 2024

2.2.0 minor

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Nov 13, 2024

2.1.1 patch

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Apr 26, 2023

2.1.0 minor

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Apr 26, 2023

2.0.0 major

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Sep 08, 2020

1.9.0 minor

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Sep 08, 2020

2.0.0-rc.0 pre

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Jan 21, 2020

1.9.0-rc.0 pre

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Jan 07, 2020

1.8.1 patch

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Dec 20, 2019

1.8.0 minor

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Jun 24, 2019

1.7.0 minor

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Feb 16, 2019

1.6.0 minor

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Nov 22, 2018

1.5.0 minor

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Mar 24, 2018

1.4.1 patch

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Oct 12, 2017

1.4.0 minor

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Jun 25, 2017

1.3.1 patch

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Nov 11, 2016

1.3.0 minor

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Nov 10, 2016

1.2.0 minor

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Sep 26, 2016

1.1.2 patch

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Apr 24, 2016

1.1.1 patch

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Dec 26, 2015

1.1.0 minor

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Dec 31, 2014

1.0.1 patch

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Dec 16, 2014

1.0.0 major

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Dec 09, 2014

0.2.5 patch

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Sep 09, 2014

0.2.4 patch

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Aug 03, 2014

0.2.3 patch

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Jul 13, 2014

0.2.2 patch

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Jun 18, 2014

0.2.1 patch

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

May 24, 2014

0.2.0 minor

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

May 01, 2014

0.1.2 patch

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Apr 21, 2014

0.1.1 initial

1 CVE

CVE-2026-32686 GHSA-rhv4-8758-jx7v EEF-CVE-2026-32686 May 12, 2026

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

Medium

Local Low None None

Summary decimal doesn't bound the exponent on parsed input, so something like "1e10000000" is parsed fine but then explodes the memory to more than 7GB if you run e.g. Decimal.add(Decimal.parse("1e10000000"), 1) because for positive exp, the function tail-recurses with coef * 10 and exp - 1 per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.

Details

Decimal.new/parse/cast happily store huge exponents. After that, a bunch of core paths allocate proportional to exp:

add/sub/div go through add_align, which calls pow10(exp1 - exp2) and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).
to_string/2 with :normal (also :xsd and the String.Chars impl) does :lists.duplicate(exp, ?0) (lib/decimal.ex:1506, 1513).
to_integer/1 recurses coef * 10, exp - 1 once per unit of exp (lib/decimal.ex:1603-1605).
round/3 does the same :lists.duplicate trick on the exp difference (lib/decimal.ex:1850, 1874).
compare/3 with a threshold argument loops back into add/sub, so it's vulnerable too (lib/decimal.ex:331-332).

PoC

Any of these will hang or OOM the BEAM:

Decimal.add(Decimal.new("1"), Decimal.new("1e1000000000"))
Decimal.to_string(Decimal.new("1e1000000000"), :normal)
Decimal.to_integer(Decimal.new("1e1000000000"))
Decimal.round(Decimal.new("1e1000000000"))

Impact

Unauthenticated remote DoS. Anything that takes a user-supplied decimal (JSON, form field, Ecto :decimal field — basically everywhere) and then does arithmetic, rounding, to_integer, or to_string on it is exposed. One request can kill the node with a Out-of-Memory exception.

Note on the security fixes done in version 2.4.0

While 2.4.0 has the changes to mitigate this issue it's not considered as a patched version because it doesn't have them enabled by default.

Affected versions


          0.1.1


          0.1.2


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5


          1.0.0


          1.0.1


          1.1.0


          1.1.1

+ 21 more


            1.1.2


            1.2.0


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.9.0


            1.9.0-rc.0


            2.0.0


            2.0.0-rc.0


            2.1.0


            2.1.1


            2.2.0


            2.3.0


            2.4.0


            2.4.1

Fixed in


          3.0.0

References

Updated Aug 05, 2026 · Source: OSV.dev

Apr 21, 2014

Activity

Reach

Details