CVE-2026-97853: CWE-789 Memory Allocation with Excessive Size Value in ericmj decimal

The vulnerability in ericmj decimal's Decimal.round/3 function arises from memory allocation with an excessive size value. Specifically, when rounding decimals with a large positive or negative 'places' argument, the function constructs a charlist of zero digits proportional to the absolute value of 'places' before applying precision limits. For example, calling Decimal.round(Decimal.new("1.5"), -50_000_000) can allocate approximately 5.5 GB of memory, which can exhaust available system memory and cause the BEAM VM to terminate. Older versions also consume CPU in proportion to 'places' due to looping behavior. The issue affects all versions from 0.1.0 up to but excluding 3.1.2. Input limits added for a related CVE do not cover this 'places' argument, leaving applications that accept user-supplied 'places' values without bounds exposed to denial of service.

The impact is denial of service caused by excessive memory allocation leading to potential exhaustion of system memory and termination of the BEAM virtual machine. This can disrupt availability of applications using the vulnerable decimal library when processing untrusted input for decimal rounding.

No explicit patch or fix is stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications should implement input validation to bound the 'places' argument passed to Decimal.round/2 or Decimal.round/3 to prevent excessive memory allocation. Avoid accepting untrusted or unbounded user input for this parameter.