BigDecimal is a Java class for exact decimal arithmetic. Unlike floating-point types, it preserves precision and scale, making it a common choice for money, percentages, and other values where rounding errors matter. In web applications, frameworks may bind request parameters into BigDecimal fields automatically, then use those values in templates or tags when building a response.
That convenience can become security-relevant when an application trusts the bound value too much. A very large or carefully crafted decimal can trigger expensive parsing, conversion, or rendering work, increasing CPU and memory usage and sometimes producing oversized responses. If the value is later reflected back to users, it can also expose formatting bugs or cross-user state problems in shared components. Defenders should validate range and scale, limit request size, and treat data binding and rendering as separate security boundaries.