CVE-2026-97853Published

Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS

Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-97853

Published

decimal

https://repo.hex.pm

Original vendor version evidence · not evaluated as a NuGet range

{
                    "collectionURL": "https://repo.hex.pm",
                    "cpes": [
                        "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "'Elixir.Decimal'"
                    ],
                    "packageName": "decimal",
                    "packageURL": "pkg:hex/decimal",
                    "product": "decimal",
                    "programFiles": [
                        "lib/decimal.ex"
                    ],
                    "programRoutines": [
                        {
                            "name": "'Elixir.Decimal':round/2"
                        },
                        {
                            "name": "'Elixir.Decimal':round/3"
                        }
                    ],
                    "repo": "https://github.com/ericmj/decimal",
                    "vendor": "ericmj",
                    "versions": [
                        {
                            "lessThan": "3.1.2",
                            "status": "affected",
                            "version": "0.1.0",
                            "versionType": "semver"
                        }
                    ]
                }

ericmj/decimal

https://github.com

Original vendor version evidence · not evaluated as a NuGet range

{
                    "collectionURL": "https://github.com",
                    "cpes": [
                        "cpe:2.3:a:ericmj:decimal:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "'Elixir.Decimal'"
                    ],
                    "packageName": "ericmj/decimal",
                    "packageURL": "pkg:github/ericmj/decimal",
                    "product": "decimal",
                    "programFiles": [
                        "lib/decimal.ex"
                    ],
                    "programRoutines": [
                        {
                            "name": "'Elixir.Decimal':round/2"
                        },
                        {
                            "name": "'Elixir.Decimal':round/3"
                        }
                    ],
                    "repo": "https://github.com/ericmj/decimal",
                    "vendor": "ericmj",
                    "versions": [
                        {
                            "changes": [
                                {
                                    "at": "338f42c8cf6a9749ab70c5af04734c6050ca3dc6",
                                    "status": "unaffected"
                                },
                                {
                                    "at": "3c90af4c3c2dfa4bb4c138760a326dd0eb91822b",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThan": "*",
                            "status": "affected",
                            "version": "05bb73eb40ddef24eda782d905766f56a3660522",
                            "versionType": "git"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON