CVE-2026-5233: Missing Rate Limiting in Mia Technologies' Pizzy Library

Synopsis

Missing rate limiting in MIA Technology Inc.'s Pizzy Library allows an authenticated attacker to flood the service over the network. The vulnerability requires a low-privilege account but no victim interaction, and is reliably exploitable without special conditions. Successful exploitation allows the attacker to cause a denial of service, crashing or severely degrading the affected service, while also enabling limited data tampering. A patched-image rebuild at version 1.3.9.26250 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Pizzy Library service over the network; the attack vector is remote (AV:N).

• AuthenticationRequired

  The attacker must hold a valid low-privilege account on the target system; no elevated or admin credentials are required (PR:L).

• Victim interactionNot required

  No user or operator action is needed to trigger the vulnerability; the attacker acts entirely on their own (UI:N).

• Attack complexityDetail

  Exploitation is reliable and condition-free, requiring no race conditions or special environmental setup (AC:L).

Blast Radius

• Crashes or severely degrades the Pizzy Library service, making it unavailable to legitimate callers.
• Allows limited writes or modifications to data handled by the library (integrity impact: low).
• Downstream services or clients depending on the Pizzy Library endpoint experience sustained outage for the duration of a flood attack.