Post

🚨 Please update "decimal" 🚨 A *single* calculation like: Decimal.new("1e1_000_000_000") |> Decimal.add(1) will OOM your application. Poof. Adios. Auf Wiedersehen. cna.erlef.org/cves/CVE-202...

cna.erlef.orgUnbounded exponent in decimal enables unauthenticated DoSThis project handles the CVE Numbering Authority (CNA) for the Erlang Ecosystem Foundation (EEF).

7/5/26, 2:43 pm9 reposts24 likes

Yevhenii Kurtov

@yevhenii.kurtov.pro

7 May

It would be great if Ericsson got access to Mythos. It seems t one on a completely different level arstechnica.com/information-...

arstechnica.comMozilla says 271 vulnerabilities found by Mythos have "almost no false positives"The developer of Firefox says it has "completely bought in" on AI-assisted bug discovery.

Peter Ullrich

@peterullrich.com

7 May

Forget Ericsson, **I** want access to Mythos 😄

Yevhenii Kurtov

@yevhenii.kurtov.pro

8 May

dude, if you'd get access to Mythos rn, you'd be set for life :)

Christophe

@genserver.be

7 May

You're really doing a great job with this, thanks :)

Peter Ullrich

@peterullrich.com

7 May

Thank you 😊 that’s much appreciated !

Gus Workman

@gworkman.bsky.social

8 May

It was quite entertaining to be in the room when you tested this and OOM’ed yourself 😆

Adolfo Neto

@adolfoneto.elixiremfoco.com

10 May

Sorry, what's OOM? // Thanks for your work on vulnerabilities!

Peter Ullrich

@peterullrich.com

10 May

Out of memory. If your server has 1GB of RAM, the BEAM will shut down when it reaches that limit. With the vulnerability mentioned in the report, a malicious request can easily use many GBs of RAM so effectively shutting down your application

Adolfo Neto

@adolfoneto.elixiremfoco.com

Thanks!!!

Hahahahaha! Sorry not sorry 😬