AIKIDO-2026-342302
decimal is vulnerable to Denial of Service (DoS)
62
Medium Risk
This Affects:
decimalTL;DR
Decimal.round/2 and Decimal.round/3 build the full result for a caller supplied places value before the context precision is applied. One call can allocate gigabytes and kill the BEAM VM. A large positive places value raises SystemLimitError after building a long list of zeros, and Decimal.to_integer/1 or Decimal.to_float/1 then builds a power of ten for that zero. The fix caps padding at the context precision and returns 0 or 0.0 for a zero coefficient.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application passes an untrusted places value to Decimal.round/2 or Decimal.round/3.
Background info
decimal is vulnerable to Denial of Service (DoS) in versions 0.1.0 - 3.1.1.
How to fix this
Upgrade the decimal library to the patch version.
Links
GitHub Release
Fix Commits
github.com/ericmj/decimal/commit/05bb73eb40ddef24eda782d905766f56a3660522github.com/ericmj/decimal/commit/338f42c8cf6a9749ab70c5af04734c6050ca3dc6github.com/ericmj/decimal/commit/3c90af4c3c2dfa4bb4c138760a326dd0eb91822b
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.