AIKIDO-2026-670539

TL;DR

The jsonschema crate validates numeric instances against minimum, maximum, and their exclusive variants. When the arbitrary-precision feature is enabled, integer instances just outside the i64/u64 range are compared against these bounds after a lossy conversion to f64, so a value one step beyond the limit rounds onto the boundary and is treated as satisfying it. An instance that actually violates a numeric bound can therefore be accepted as valid, bypassing the schema constraint on untrusted input. The fix compares such out-of-range integers exactly using big-integer arithmetic instead of f64 rounding.