CVE-2026-27695

Published: Feb 25, 2026Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

zae-limiter is a rate limiting library using the token bucket algorithm. Prior to version 0.10.1, all rate limit buckets for a single entity share the same DynamoDB partition key (`namespace/ENTITY#{id}`). A high-traffic entity can exceed DynamoDB's per-partition throughput limits (~1,000 WCU/sec), causing throttling that degrades service for that entity — and potentially co-located entities in the same partition. Version 0.10.1 fixes the issue.

Affected (1)

Products: Zeroae: Zae Limiter

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zeroae Zae Limiter	Before 0.10.1

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (2)

https://github.com/zeroae/zae-limiter/releases/tag/v0.10.1

Source: security-advisories@github.com

Release Notes

https://github.com/zeroae/zae-limiter/security/advisories/GHSA-76rv-2r9v-c5m6

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.