Elixir Decimal EUVD-2026-96426

Exploitation requires the consuming application to pass an attacker-controlled or otherwise unbounded number of decimal places/scale into Decimal.round/2 or Decimal.round/3 (for example a large negative value like -50,000,000, or a large positive places value), because Decimal.round builds the full result before the 34-digit context precision is applied. The LIMITING factor is that this is not triggered by default or fixed-scale library usage - the application must forward untrusted input to this specific function without clamping its magnitude, and the input limits previously added for CVE-2026-32686 explicitly do NOT cover the places argument. There is no authentication requirement or special configuration inside the library itself (PR:N in the supplied vector), but realistic exposure depends entirely on whether a reachable code path relays user input to the places parameter.

This is a medium-severity availability-only Denial of Service (official CVSS 4.0 base 6.9, VC:N/VI:N/VA:H - no confidentiality or integrity impact). The exploitation status is 'no public exploit identified at time of analysis': there is no CISA KEV listing and no POC flag in the provided intelligence, and no EPSS probability was supplied, so widespread automated exploitation cannot be inferred - absence of these signals is not evidence of safety but does lower immediate priority. SIGNAL CONFLICT TO VERIFY: the official vector sets AV:L (local), yet the description frames the threat as 'any application that passes a user-supplied number of decimal places... without bounding it,' which in practice means a network-facing web/API endpoint forwarding untrusted input - the realistic attack surface is remote, so the AV:L label likely reflects the CNA scoring only the library's direct API rather than the deployed exposure; verify against your own call sites. Net assessment: this is a real, cheaply-triggered DoS (a single call allocates ~5.5 GB) but is strictly conditional on application code forwarding an unbounded places/scale argument to Decimal.round/2 or /3 - it is not an unconditional remote crash of every deployment. Treat as a prompt patch/code-audit item for Elixir services doing user-driven decimal rounding, not a drop-everything emergency.

An attacker locates a network endpoint in an Elixir application that forwards a user-controlled rounding scale into Decimal.round, then submits a request with an extreme value such as places = -50,000,000. Decimal.round builds a multi-gigabyte zero-digit charlist before applying context precision, allocating roughly 5.5 GB and exhausting memory until the BEAM VM is killed. No public exploit code was identified, but the condition is trivially triggered by a single crafted value and requires no authentication within the library itself.