CVE-2026-27695

{"id": "CVE-2026-27695", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2026-02-25T15:20:52.907", "references": [{"url": "https://github.com/zeroae/zae-limiter/releases/tag/v0.10.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/zeroae/zae-limiter/security/advisories/GHSA-76rv-2r9v-c5m6", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "zae-limiter is a rate limiting library using the token bucket algorithm. Prior to version 0.10.1, all rate limit buckets for a single entity share the same DynamoDB partition key (`namespace/ENTITY#{id}`). A high-traffic entity can exceed DynamoDB's per-partition throughput limits (~1,000 WCU/sec), causing throttling that degrades service for that entity \u2014 and potentially co-located entities in the same partition. Version 0.10.1 fixes the issue."}, {"lang": "es", "value": "zae-limiter es una librer\u00eda de limitaci\u00f3n de velocidad que utiliza el algoritmo de cubo de tokens. Antes de la versi\u00f3n 0.10.1, todos los cubos de l\u00edmite de velocidad para una \u00fanica entidad comparten la misma clave de partici\u00f3n de DynamoDB ('namespace/ENTITY#{id}'). Una entidad de alto tr\u00e1fico puede exceder los l\u00edmites de rendimiento por partici\u00f3n de DynamoDB (~1.000 WCU/seg), causando una limitaci\u00f3n que degrada el servicio para esa entidad \u2014 y potencialmente para entidades coubicadas en la misma partici\u00f3n. La versi\u00f3n 0.10.1 corrige el problema."}], "lastModified": "2026-02-26T15:38:45.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zeroae:zae-limiter:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF53AB9A-4E88-4C25-9752-3564CD7DDA1D", "versionEndExcluding": "0.10.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}