AIKIDO-2026-42802

TL;DR

When parsing a decimal value from a request string, the Encore runtime passes the input directly to the underlying rational-number parser without bounding its length or magnitude. A value with an extremely large exponent in scientific notation or an implausibly long decimal string causes the runtime to try to materialize an enormous number, consuming excessive memory and CPU and potentially crashing the service. Only applications that accept a decimal-typed value in a request are affected. The fix validates decimal strings before parsing and rejects inputs that are too long or whose base-10 exponent is far outside any legitimate value.