Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2026-27695

zae-limiter: DynamoDB hot partition throttling enables per-entity Denial of Service

Description

zae-limiter is a rate limiting library using the token bucket algorithm. Prior to version 0.10.1, all rate limit buckets for a single entity share the same DynamoDB partition key (`namespace/ENTITY#{id}`). A high-traffic entity can exceed DynamoDB's per-partition throughput limits (~1,000 WCU/sec), causing throttling that degrades service for that entity — and potentially co-located entities in the same partition. Version 0.10.1 fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

zeroae zae-limiter

  • < 0.10.1affected

References