maennchen
Security advisory: Decimal DoS vulnerability
A vulnerability has been published for decimal where very large exponents can cause excessive memory allocation and crash the BEAM VM.
Affected versions: decimal < 3.0.0
Fixed in: decimal 3.0.0
CVE: CVE-2026-32686
GHSA: GHSA-rhv4-8758-jx7v
We recommend updating immediately.
decimal v3.0.0 enforces safer defaults. This is technically a breaking change, but for most use cases it should not require application changes. If needed, we recommend overriding the dependency explicitly:
{:decimal, "~> 3.0", override: true}
Where Next?
Trending in Discussions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Courses that'll move you from confusion to "Aha, now I get it!"
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #ai
- #elixirconf-us
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #elixirconf-eu
- #metaprogramming
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Practical resources that improve the lives of professional developers.
Producing high quality Elixir screencasts since 2017.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 9- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
dimitarvp
Just upgraded to 3.0.0 and ran a pretty slow financial test suite from scratch. No regressions! Great work, thank you.
Hermanverschooten
Better upgrade to 3.1, 3.0 has a bug that causes an infinite loop.
It caused my tests to hang.
adamzapasnik
Thank you for reporting it.
Does anyone know/understand why
mix deps.auditdoesn’t report it?maennchen
MixAudit relies on the GitHub Advisory DB. It is unfortunately often a few days out of date. In this case as well.
We’re however working on integrating this directly as warnings in
deps.getandhex.audit. (Currently only checks for retirement status; You can already see the vulnerabilities on hex.pm package pages).The data there relies on OSV.dev and therefore directly contains EEF CNA, GHSA and other reporters, see OSV - Open Source Vulnerabilities
adamzapasnik
Thanks for the explanation, now I get the reason for this post I guess
. I didn’t know it was absent from the GitHub Advisory DB, I assumed it was there already since it’s been assigned GHSA ID 
Happy to know that you’re aware of it and there is work being done to improve the tools
dimitarvp
Well I actually mistyped. I’m on 3.1.0 indeed.
gmile
If I run
mix hex.audittoday I get:I am on 3.1.1 of decimal.
But is 3.1.1 really affected by this? If yes - then is there a version with mitigation in the works? I can skip the advisory, but I wonder what’s a proper way to handling it.
maennchen
@gmile We had an error in the record. It has a
defaultStatusofaffectedand declared more affected ranges.Before a new release of our tooling yesterday, that error did not surface since
defaultStatuswas not supported. Now that it is, it correctly deduced that all versions are affected.I have corrected it so that the
defaultStatusisunaffected.gmile
Thank you for a quick fix, much appreciated!