AIKIDO-2026-363220

TL;DR

The RustDecimal extension performs arithmetic with panicking Rust operators instead of checked variants. Evaluating a crafted decimal expression that overflows, such as adding 1 to RustDecimal('79228162514264337593543950335'), raises a Rust panic that crosses the PyO3 boundary and poisons the Module mutex during unwinding. Every later operation on that module then fails with a poison error, leaving it permanently unusable and killing cached-module workers. The fix routes +, -, *, /, //, and % through checked arithmetic and returns a Starlark IntegerOverflow error.