CVE-2026-27695: Zeroae Zae-limiter DoS Vulnerability

CVE-2026-27695 Overview

CVE-2026-27695 is a Resource Exhaustion vulnerability affecting zae-limiter, a rate limiting library that implements the token bucket algorithm. Prior to version 0.10.1, all rate limit buckets for a single entity share the same DynamoDB partition key (namespace/ENTITY#{id}). This design flaw allows a high-traffic entity to exceed DynamoDB's per-partition throughput limits (~1,000 WCU/sec), causing throttling that degrades service for that entity and potentially co-located entities in the same partition.

Critical Impact

Service degradation and denial of service conditions can occur when high-traffic entities exceed DynamoDB partition throughput limits, affecting both the targeted entity and co-located entities sharing the same partition.

Affected Products

• zeroae zae-limiter versions prior to 0.10.1

Discovery Timeline

• 2026-02-25 - CVE CVE-2026-27695 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27695

Vulnerability Analysis

This vulnerability stems from an improper resource allocation design (CWE-770: Allocation of Resources Without Limits or Throttling) in the zae-limiter library. The library uses DynamoDB as its backend storage for maintaining rate limit state across distributed systems using the token bucket algorithm.

The core issue lies in how the library structures its DynamoDB partition keys. All rate limit buckets associated with a single entity are stored under the same partition key following the pattern namespace/ENTITY#{id}. DynamoDB has inherent per-partition throughput limitations of approximately 1,000 write capacity units (WCU) per second.

When an entity generates high volumes of rate-limiting requests, all associated write operations target the same partition. This creates a "hot partition" scenario where the throughput ceiling is quickly reached, triggering DynamoDB's built-in throttling mechanisms.

The attack can be exploited remotely over the network and requires no authentication or user interaction. While the vulnerability does not impact confidentiality or integrity, it can cause availability degradation for affected services.

Root Cause

The root cause is an architectural limitation in the partition key design. By consolidating all rate limit buckets for an entity under a single partition key, the library creates a bottleneck that cannot scale horizontally. DynamoDB automatically partitions data across multiple physical storage units, but all items sharing the same partition key must reside on the same partition, limiting throughput regardless of provisioned capacity.

Attack Vector

An attacker can exploit this vulnerability by generating sustained high-frequency requests against a single entity's rate-limited endpoints. The attack requires only network access to the application using the vulnerable zae-limiter library. The exploitation mechanism works as follows:

1. The attacker identifies or creates a target entity in the rate-limited system
2. The attacker generates high-volume requests against endpoints associated with that entity
3. Each request triggers a write operation to DynamoDB using the shared partition key
4. Once throughput exceeds ~1,000 WCU/sec, DynamoDB begins throttling requests
5. Legitimate requests for the targeted entity and co-located entities experience degraded service

No proof-of-concept code is publicly available for this vulnerability. The attack is conceptually straightforward, requiring only the ability to generate sustained request volumes against rate-limited endpoints. For additional technical details, see the GitHub Security Advisory.

Detection Methods for CVE-2026-27695

Indicators of Compromise

• Elevated DynamoDB ThrottlingException errors in application logs targeting rate limiter tables
• Unusual spikes in write operations to rate limiter DynamoDB partitions
• Service degradation reports from multiple entities that appear to be correlated
• CloudWatch metrics showing hot partition warnings for rate limiter tables

Detection Strategies

• Monitor DynamoDB CloudWatch metrics for WriteThrottledRequests and ProvisionedWriteCapacityUnits consumption patterns
• Implement alerting on DynamoDB throttling events specifically for tables used by zae-limiter
• Deploy distributed tracing to correlate service degradation with rate limiter operations
• Audit application dependencies to identify usage of zae-limiter versions prior to 0.10.1

Monitoring Recommendations

• Enable DynamoDB Contributor Insights to identify hot partition keys in rate limiter tables
• Configure CloudWatch alarms for throttling metrics with appropriate thresholds
• Implement application-level logging for rate limiter operations to track entity-specific patterns
• Use AWS X-Ray or similar APM tools to trace latency spikes back to DynamoDB operations

How to Mitigate CVE-2026-27695

Immediate Actions Required

• Upgrade zae-limiter to version 0.10.1 or later immediately
• Review application logs for signs of existing exploitation or service degradation
• Consider implementing temporary application-level rate limiting as a defensive layer
• Audit all deployments using zae-limiter to ensure comprehensive patching

Patch Information

The vulnerability has been fixed in zae-limiter version 0.10.1. The patch addresses the partition key design to prevent throughput bottlenecks from affecting service availability. Organizations should upgrade by updating their dependency to the latest version.

For detailed patch information, refer to the GitHub Release v0.10.1 and the GitHub Security Advisory GHSA-76rv-2r9v-c5m6.

Workarounds

• Implement DynamoDB on-demand capacity mode to better handle burst traffic patterns
• Deploy write sharding by adding random suffixes to partition keys at the application level (temporary measure)
• Configure DynamoDB auto-scaling with aggressive scale-up policies to mitigate throttling impact
• Consider implementing a secondary rate limiting layer using in-memory solutions like Redis as a buffer

# Update zae-limiter to patched version
pip install --upgrade zae-limiter>=0.10.1

# Verify installed version
pip show zae-limiter | grep Version