The ericmj decimal library improperly handles decimal inputs with very large exponents, such as "1e1000000000", by not bounding the exponent size. When such inputs are processed through arithmetic functions (add, sub, div), string conversions (to_string with :normal or :xsd), integer conversion, rounding, or comparison, the library allocates memory proportional to the exponent value. This uncontrolled resource consumption can exhaust system memory and crash the BEAM virtual machine. The vulnerability affects versions from 0.1.0 up to but not including 3.0.0 and can be exploited remotely without authentication by submitting crafted decimal values.

An attacker can cause a denial of service by sending a single malicious decimal input with a very large exponent to an application using the affected decimal library. This leads to excessive memory allocation during decimal operations, resulting in an out-of-memory crash of the BEAM VM. The impact is limited to denial of service; no information disclosure or code execution is indicated. The vulnerability requires the application to accept user-supplied decimal input and perform arithmetic or conversion operations on it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications should implement input validation to restrict the size of decimal exponents accepted from untrusted sources to prevent excessive resource consumption. Avoid processing decimal inputs with extremely large exponents. Monitor for updates from the ericmj decimal library maintainers regarding patches or official mitigations.