{"answers":{"affected":"3 open source packages ship an affected version, including decimal.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32686 exists.","fix":"Upgrade decimal to 3.0.0 or later.","what":"CVE-2026-32686 is a medium-severity denial of service vulnerability in ericmj decimal, published on 7 May 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-32686 and fix it if it is affected.\n\nWhat it is: CVE-2026-32686 is a medium-severity denial of service vulnerability in ericmj decimal, published on 7 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32686 exists.\n\nAffected packages and fixed versions:\n- decimal (Hex): affected from 0.1.0; fixed in 3.0.0\n- decimal (Hex): affected from 0.1.0; fixed in 3.0.0\n- decimal (Hex): affected from 0.1.0; fixed in 3.0.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-32686/ (Markdown: https://insights.sbomify.com/CVE-2026-32686/index.md)","id":"CVE-2026-32686","markdown":"https://insights.sbomify.com/CVE-2026-32686/index.md","name":"CVE-2026-32686","record":{"aliases":["EEF-CVE-2026-32686","GHSA-rhv4-8758-jx7v"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Elixir decimal library","requires_auth":"none","summary":"Attackers can crash the BEAM VM by sending decimal inputs with huge exponents, causing memory exhaustion in applications using the decimal library.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"EEF","cpe":[],"cvss":{"score":6.9,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"description":"Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.\n\nThe decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new(\"1e1000000000\")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.\n\nAny application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.\n\nThis issue affects decimal: from 0.1.0 before 3.0.0.","ecosystems":["Hex"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Unbounded exponent in decimal enables unauthenticated DoS","id":"CVE-2026-32686","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Hex","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":3,"n_references":5,"next":{"headline":"SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3","id":"CVE-2026-32687"},"packages":[{"ecosystem":"Hex","fixed":["3.0.0"],"introduced":["0.1.0"],"last_affected":[],"package":"decimal","purl":"pkg:hex/decimal","source":"EEF-CVE-2026-32686"},{"ecosystem":"Hex","fixed":["3.0.0"],"introduced":["0.1.0"],"last_affected":[],"package":"decimal","purl":null,"source":"GHSA-rhv4-8758-jx7v"},{"ecosystem":"Hex","fixed":["3.0.0"],"introduced":["0.1.0"],"last_affected":[],"package":"decimal","purl":"pkg:hex/decimal","source":"GHSA-rhv4-8758-jx7v"}],"prev":{"headline":"Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and Write","id":"CVE-2026-32685"},"products":["decimal"],"published":"2026-05-07","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Erlang Ecosystem Foundation","prefix":"EEF"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-08","vendors":["ericmj"]},"summary":"Attackers can crash the BEAM VM by sending decimal inputs with huge exponents, causing memory exhaustion in applications using the decimal library.","url":"https://insights.sbomify.com/CVE-2026-32686/"}