The decimal library accepts numeric strings that contain arbitrarily large exponents without performing bounds checks. A value such as "1e1000000000" is parsed successfully, yet subsequent arithmetic, conversion, or formatting operations allocate memory proportional to the exponent. This uncontrolled allocation can exhaust the BEAM VM’s memory and cause the process to terminate, resulting in a denial of service. The vulnerability is classified as an uncontrolled resource consumption flaw (CWE‑400) and can be triggered by a single unauthenticated request.

All releases of the ericmj decimal library from version 0.1.0 up through any release before 3.0.0 are affected. Any application that includes one of those versions and accepts user‑supplied decimal strings is vulnerable.

The CVSS score of 6.9 indicates a moderate‑to‑high impact. While the EPSS score is not available and the vulnerability is not listed in CISA KEV, the lack of authentication or privilege requirements means the exploitability is high for any exposed application that processes untrusted decimal input. An attacker only needs to send a large‑exponent decimal string to the target, and the out‑of‑memory crash can take the process or entire node down if not mitigated.