Medium, CVSS 4.3PyPIAmendedPublished
zae-limiter: DynamoDB hot partition throttling enables per-entity Denial of Service
CVE-2026-27695 · GHSA-76rv-2r9v-c5m6
- Affected
- PyPI zae-limiter <= 0.10.0
- Fixed in
- 0.10.1· Vendor fix available
- Issue
- All rate limit buckets for a single entity share the same DynamoDB partition key (namespace/ENTITY#{id}). A high-traffic entity can exceed DynamoDB's per-partition throughput limits (~1,000 WCU/sec), causing throttling that degrades service for that entity — and potentially co-located entities in the same partition. Details Each acquire() call performs a TransactWriteItems (or UpdateItem in speculative mode) against items sharing the same partition key. For cascade entities, this doubles to 2-4 writes per request (child + parent). At sustained rates above ~500 req/sec for a single entity, DynamoDB's adaptive capacity may not redistribute fast enough, causing ProvisionedThroughputExceededException. The library has no built-in mitigation: - No partition key sharding/salting - No write coalescing or batching - No client-side admission control before hitting DynamoDB - RateLimiterUnavailable is raised but the caller has already been delayed Impact - Availability: High-traffic…
Recommended action: Upgrade to 0.10.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.