CVE-2026-97853
Description
A flaw was found in decimal. An attacker can exploit this vulnerability by supplying an unbounded or excessively large number of decimal places to rounding operations. This causes the library to allocate disproportionate memory and consume excessive processor resources, potentially crashing the application and resulting in a Denial of Service (DoS).
Statement
This vulnerability is rated as Moderate because successful exploitation is contingent on an application processing unvalidated, user-supplied precision values, limiting the impact strictly to a denial of service. When an overly large scale value is processed during arithmetic rounding operations, the underlying runtime may consume excessive memory and crash the affected service. Because confidentiality and data integrity remain unaffected and the issue cannot be triggered without specific application exposure, the risk to Red Hat environments is reduced.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
