CVE-2026-32686 describes an uncontrolled resource consumption vulnerability (CWE-400) in the ericmj decimal library. The library does not bound the exponent on parsed decimal inputs, enabling attackers to supply extremely large exponents that cause exponential memory growth during operations such as add, subtract, divide, to_string, to_integer, round, and compare. This is due to tail-recursive multiplication and list duplication proportional to the exponent value. The impact is an unauthenticated remote denial of service by exhausting memory and crashing the BEAM node. Mitigations were introduced in version 2.4.0 but are not enabled by default, so this version is not considered fully patched. A patch is available but the exact fixed version is not specified in the input data.

An attacker can cause a denial of service by sending decimal inputs with very large exponents to any system using the ericmj decimal library that performs arithmetic or conversions on user-supplied decimals. This can lead to Out-of-Memory exceptions and crash the BEAM runtime, potentially taking down the affected node with a single request. The vulnerability affects unauthenticated remote users and can be triggered via common input vectors such as JSON, form fields, or Ecto decimal fields.

A patch is available for this vulnerability. Although version 2.4.0 includes mitigations, they are not enabled by default and thus it is not considered a fully patched version. Users should upgrade to a version where the mitigations are enabled by default once such a version is released. Until then, consider implementing input validation to restrict exponent sizes on decimal inputs to prevent exploitation.