CVE-2026-27695

Katalog CVE

CVSS 5.3 · Medium EPSS 0,40%

Kerentanan Allocation of Resources Without Limits or Throttling pada zeroae zae-limiter. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

zae-limiter is a rate limiting library using the token bucket algorithm. Prior to version 0.10.1, all rate limit buckets for a single entity share the same DynamoDB partition key (`namespace/ENTITY#{id}`). A high-traffic entity can exceed DynamoDB's per-partition throughput limits (~1,000 WCU/sec), causing throttling that degrades service for that entity — and potentially co-located entities in the same partition. Version 0.10.1 fixes the issue.

Rincian

Terbit di NVD

25 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/zeroae/zae-limiter/security/advisories/GHSA-76rv-2r9v-c5m6 advisory vendor
• https://github.com/zeroae/zae-limiter/releases/tag/v0.10.1 release notes