p PatchFirst

CVE-2026-27695

CVE-2026-27695 · zae-limiter: DynamoDB hot partition throttling enables per-entity Denial of Service

This page contains facts from public vulnerability sources. Check the original advisory before updating.

zae-limiter is a rate limiting library using the token bucket algorithm. Prior to version 0.10.1, all rate limit buckets for a single entity share the same DynamoDB partition key (`namespace/ENTITY#{id}`). A high-traffic entity can exceed DynamoDB's per-partition throughput limits (~1,000 WCU/sec), causing throttling that degrades service for that entity — and potentially co-located entities in the same partition. Version 0.10.1 fixes the issue.

CVSS 4.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • zae-limiter

    Versions
    • < 0.10.1: Affected

    No fix published

  • zae-limiter PyPI

    Versions
    • 0.1.0
    • 0.10.0
    • 0.2.0
    • 0.3.0
    • 0.4.0
    • 0.4.1
    • 0.5.0
    • 0.6.0
    • 0.6.1
    • 0.7.0
    • 0.8.0
    • 0.8.1
    • 0.9.0
    • 0.9.1
    Affected ranges
    • ECOSYSTEM: < 0.10.1

    Update to 0.10.1

Original sources

Check your server →