{"data":{"id":"7f26d249-570e-43c6-a0dc-aff4a3a9b37f","title":"GHSA-76rv-2r9v-c5m6: zae-limiter: DynamoDB hot partition throttling enables per-entity Denial of Service","summary":"The zae-limiter library places all rate limit buckets for one entity under a single DynamoDB partition key (`namespace/ENTITY#{id}`). A high-traffic entity can exceed DynamoDB's per-partition throughput limit of about 1,000 WCU/sec, causing `ProvisionedThroughputExceededException` throttling that degrades that entity and possibly other entities sharing the partition. The source states that no built-in mitigation exists in the library at present.","solution":"The source proposes a remediation design called Pre-Shard Buckets: buckets move to `PK={ns}/BUCKET#{entity}#{resource}#{shard}, SK=#STATE` so each (entity, resource, shard) gets its own partition, shards double from 1 to 2 to 4 to 8 on `wcu` exhaustion or proactively by the aggregator, and an auto-injected `wcu:1000` reserved limit tracks partition write pressure. The source describes this as a design, not a released fix, and names no fixed version.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-76rv-2r9v-c5m6","publishedAt":"2026-02-25T22:31:10.000Z","cveId":"CVE-2026-27695","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["zae-limiter@<= 0.10.0 (fixed: 0.10.1)"],"affectedPackageNames":["zae-limiter"],"affectedPackageRefs":["pypi:zae-limiter"],"affectedVendors":["Amazon"],"affectedVendorsRaw":["zae-limiter","DynamoDB"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00267,"epssCheckedAt":"2026-11-04T12:08:33.690Z","kevDateAdded":null,"advisoryAliases":["GHSA-76rv-2r9v-c5m6"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-23T02:38:34.689Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:40:30.646Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.7,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"zae-limiter","fixedVersion":"0.10.1","matchedVersion":"0.10.1","fixReleasedAt":"2026-02-23T02:38:34.689Z","daysToFix":-2,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:30.497Z"}]}}