CVE-2026-97853 Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS
Attackers can cause denial of service by supplying large decimal place arguments, exhausting memory in applications using the Elixir decimal library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97853?
CVE-2026-97853 is a medium-severity denial of service vulnerability in ericmj decimal, published on 10 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service.
Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the places argument instead of with the size of the result. For positive places it appends places zero digits to the coefficient as a charlist before converting it to an integer, and for negative places it builds a charlist of -places zero digits. A single call such as Decimal.round(Decimal.new("1.5"), -50_000_000) allocates about 5.5 GB of memory, which can exhaust available memory and get the BEAM VM killed. The oldest releases instead loop once per decimal place, consuming CPU in proportion to places.
Any application that passes a user-supplied number of decimal places or scale to Decimal.round/2 or Decimal.round/3 without bounding it is exposed. The input limits added for CVE-2026-32686 do not cover the places argument.
This issue affects decimal: from 0.1.0 before 3.1.2.
Weakness: CWE-789
Which versions are affected by CVE-2026-97853?
1 open source package ship an affected version, including decimal.
| Package | Affected | Fixed in |
|---|---|---|
decimal Hex | From 0.1.0 | 3.1.2 |
How do I fix CVE-2026-97853?
Upgrade decimal to 3.1.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-97853 being exploited?
There is no known exploitation of CVE-2026-97853 in the wild and no public exploit code.
Sources
Also known as EEF-CVE-2026-97853, GHSA-6c27-994x-c52f.