{"items":[{"id":"NVI-00016440","kind":"vulnerability","title":"Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-rhv4-8758-jx7v","CVE-2026-32686"],"plain_summary":"GitHub lists this reviewed advisory for decimal. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4e799029de1b3287f799bcf913e2d98e"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-26T20:10:00.160Z","value":"6.9 MEDIUM (4.0)","meaning":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db severity; no combined Null risk score.","source_id":"sr-4e799029de1b3287f799bcf913e2d98e"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-70eb3d2232f5210989b4dedbfcc2f84c","url":"https://github.com/advisories/GHSA-rhv4-8758-jx7v","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-rhv4-8758-jx7v","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T09:58:09.980Z"},{"id":"sr-4e799029de1b3287f799bcf913e2d98e","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32686","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-32686","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-07T13:57:53.294Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-70eb3d2232f5210989b4dedbfcc2f84c"],"technology":"decimal","known_exclusions":[],"conditions_summary":"Summary\n`decimal` doesn't bound the exponent on parsed input, so something like `\"1e10000000\"` is parsed fine but then explodes the memory to more than 7GB if you run e.g. `Decimal.add(Decimal.parse(\"1e10000000\"), 1)` because for positive `exp`, the function tail-recurses with `coef * 10` and `exp - 1` per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.\n\n### Details\n`Decimal.new/parse/cast` happily store huge exponents. After that, a bunch of core paths allocate proportional to `exp`:\n- `add/sub/div` go through `add_align`, which calls `pow10(exp1 - exp2)` and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).\n- `to_string/2` with `:normal` (also `:xsd` and the `String.Chars` impl) does `:lists.duplicate(exp, ?0)` (lib/decimal.ex:1506, 1513).\n- `to_integer/1` recurses `coef * 10`, `exp - 1` once per unit of `exp` (lib/decimal.ex:1603-1605).\n- `round/3` does the same `:lists.duplicate` trick on the exp difference (lib/decimal.ex:1850, 1874).\n- `compare/3` with a threshold argument loops back into `add`/`sub`, so it's vulnerable too (lib/decimal.ex:331-332).\n\n### PoC\nAny of these will hang or OOM the BEA","public_affected_ranges":[">= 0.1.0, < 3.0.0"]}],"null_published_at":"2026-11-07T18:43:12.110Z","source_updated_at":"2026-08-05T12:40:53.000Z","source_disclosed_at":"2026-05-12T15:09:20.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-03T09:58:09.980Z"},{"id":"NVI-00016440","kind":"vulnerability","title":"Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-rhv4-8758-jx7v","CVE-2026-32686"],"plain_summary":"GitHub lists this reviewed advisory for decimal. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-70eb3d2232f5210989b4dedbfcc2f84c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-70eb3d2232f5210989b4dedbfcc2f84c","url":"https://github.com/advisories/GHSA-rhv4-8758-jx7v","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-rhv4-8758-jx7v","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T09:58:09.980Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-70eb3d2232f5210989b4dedbfcc2f84c"],"technology":"decimal","known_exclusions":[],"conditions_summary":"Summary\n`decimal` doesn't bound the exponent on parsed input, so something like `\"1e10000000\"` is parsed fine but then explodes the memory to more than 7GB if you run e.g. `Decimal.add(Decimal.parse(\"1e10000000\"), 1)` because for positive `exp`, the function tail-recurses with `coef * 10` and `exp - 1` per iteration, growing the bignum coefficient by one digit each step. In the worst case, one request is enough to OOM the BEAM.\n\n### Details\n`Decimal.new/parse/cast` happily store huge exponents. After that, a bunch of core paths allocate proportional to `exp`:\n- `add/sub/div` go through `add_align`, which calls `pow10(exp1 - exp2)` and builds a giant bignum (lib/decimal.ex:1734-1738, 1827).\n- `to_string/2` with `:normal` (also `:xsd` and the `String.Chars` impl) does `:lists.duplicate(exp, ?0)` (lib/decimal.ex:1506, 1513).\n- `to_integer/1` recurses `coef * 10`, `exp - 1` once per unit of `exp` (lib/decimal.ex:1603-1605).\n- `round/3` does the same `:lists.duplicate` trick on the exp difference (lib/decimal.ex:1850, 1874).\n- `compare/3` with a threshold argument loops back into `add`/`sub`, so it's vulnerable too (lib/decimal.ex:331-332).\n\n### PoC\nAny of these will hang or OOM the BEA","public_affected_ranges":[">= 0.1.0, < 3.0.0"]}],"null_published_at":"2026-11-04T10:04:27.944Z","source_updated_at":"2026-08-05T12:40:53.000Z","source_disclosed_at":"2026-05-12T15:09:20.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T09:58:09.980Z"}],"next_cursor":null,"snapshot_revision":"42594"}