This vulnerability is an instance of uncontrolled memory allocation (CWE‑789). The function Decimal.round/3 constructs a character list of zero digits whose length equals the requested number of decimal places before converting the result to an integer. A maliciously large positive or negative places argument can cause the library to allocate gigabytes of memory, exhausting the BEAM virtual machine and terminating the application. The impact is a denial‑of‑service for any user that can influence the places argument.

The affected library is ericmj decimal, a dependency of many Elixir projects. Versions from 0.1.0 up to and including 3.1.1 are vulnerable. The fix is present in 3.1.2 and later releases.

The CVSS score of 6.9 classifies this incident as high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation has been observed to date. An attacker who can supply a large places value to Decimal.round/2 or Decimal.round/3 is able to trigger the allocation of several gigabytes of memory, which can force the BEAM VM to terminate. The feasibility of exploitation depends on whether the application exposes an interface that allows user input to determine the places argument; if such an interface exists, the risk is present.