Python 3.x has a buffer overflow which may lead to remote code execution (nvd.nist.gov)

Not everyone is using Decimal; there's a lot of applications for floats that don't justify such a heavyweight class. The first place I'd look is in numpy.