Uncontrolled resource consumption in the ericmj decimal library lets an unauthenticated actor send a decimal string with an arbitrarily large exponent. The library accepts such input without error, but later arithmetic, rounding, or formatting operations allocate memory proportional to the exponent, which can exhaust the BEAM VM’s memory and cause it to crash. As a result, any application that accepts user-supplied decimal input and performs these operations is vulnerable to a single request that triggers an out-of-memory denial of service. This flaw is a CWE-400 uncontrolled resource consumption.

All releases of the ericmj decimal library from version 0.1.0 up through any release before 3.0.0 are affected. Any application that includes one of those versions and accepts user-supplied decimal strings is vulnerable.

The CVSS score of 6.9 indicates a moderate-to-high impact. While the EPSS score of 0.00321 (<1%) indicates a low probability of exploitation in general, the lack of authentication or privilege requirements means the exploitability is high for any exposed application that processes untrusted decimal input. An attacker only needs to send a large-exponent decimal string to the target, and the out-of-memory crash can take the process or entire node down if not mitigated. The vulnerability is not listed in CISA KEV.