Skip to content
AI Sec Watch
MediumVulnerability

GHSA-76rv-2r9v-c5m6: zae-limiter: DynamoDB hot partition throttling enables per-entity Denial of Service

Source
GitHub Advisory(opens in a new tab)
Identifiers
CVE-2026-27695GHSA-76rv-2r9v-c5m6
Published
Record updated
View JSON
Affected
  • zae-limiter <= 0.10.0
Fixed in
0.10.1
  • released February 22, 2026, 2 days before disclosure
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
0.3%

Summary

The zae-limiter library places all rate limit buckets for one entity under a single DynamoDB partition key (`namespace/ENTITY#{id}`). A high-traffic entity can exceed DynamoDB's per-partition throughput limit of about 1,000 WCU/sec, causing `ProvisionedThroughputExceededException` throttling that degrades that entity and possibly other entities sharing the partition. The source states that no built-in mitigation exists in the library at present.

Mitigation

The source proposes a remediation design called Pre-Shard Buckets: buckets move to `PK={ns}/BUCKET#{entity}#{resource}#{shard}, SK=#STATE` so each (entity, resource, shard) gets its own partition, shards double from 1 to 2 to 4 to 8 on `wcu` exhaustion or proactively by the aggregator, and an auto-injected `wcu:1000` reserved limit tracks partition write pressure. The source describes this as a design, not a released fix, and names no fixed version.

Related items