What is the CVSS score of CVE-2026-5233?

CVE-2026-5233 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.2%.

Which versions of Pizzy Library are affected by CVE-2026-5233?

MIA Technology's Pizzy Library versions 1.0.0.26250 through 1.3.9.26250 contain a resource flooding vulnerability enabling authenticated users to degrade service availability and compromise data…. A patch is available.

How to fix or mitigate CVE-2026-5233?

Within 24 hours: Identify all internal and external deployments of Pizzy Library versions 1.0.0.26250-1.3.9.26250 and map network exposure. Within 7 days: Deploy rate limiting and request throttling controls on all library-exposed endpoints, and initiate testing of library versions confirmed outside the affected range per vendor guidance. Within 30 days: Complete migration to unaffected library versions or implement permanent compensating controls with continuous monitoring for resource exhaustion anomalies.

Pizzy Library CVE-2026-5233

EUVD-2026-36718 HIGH

Improper Control of Interaction Frequency (CWE-799)

2026-06-15 TR-CERT

GHSA-6554-rh36-hfh2

Information Disclosure Pizzy Library

7.1

CVSS 3.1 · NVD

Severity by source

Vendor (TR-CERT) PRIMARY

HIGH

qualitative

NVD

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

7.1 HIGH

Flooding requires only a low-privilege authenticated session over the network with no user interaction; impact is high availability loss with minor integrity side effects and no confidentiality exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Patch available

Jun 15, 2026 - 16:01 EUVD

Analysis Generated

Jun 15, 2026 - 14:30 vuln.today

DescriptionNVD

Improper Control of Interaction Frequency vulnerability in MIA Technology Inc. Pizzy Library allows Flooding.

This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250.

AnalysisAI

Resource flooding in MIA Technology Pizzy Library versions 1.0.0.26250 through 1.3.9.26250 allows authenticated remote attackers to abuse improper interaction frequency controls (CWE-799) to degrade availability and tamper with integrity. With a CVSS 3.1 base score of 7.1 and no public exploit identified at time of analysis, the flaw primarily threatens service availability in deployments that expose the library over the network. The advisory was coordinated through Turkey's TR-CERT, with no CISA KEV listing and no EPSS data provided.

Technical ContextAI

Pizzy Library is a software component published by MIA Technology Inc., and the affected CPE (cpe:2.3:a:mia_technology_inc.:pizzy_library) confirms versions in the 1.x.x.26250 build range are vulnerable. The root cause is CWE-799 (Improper Control of Interaction Frequency), meaning the library does not enforce sufficient rate limiting, throttling, or quotas on repeated operations. Without such controls, an attacker can submit operations faster than the system can safely process them, exhausting CPU, memory, connection pools, or downstream resources - the classic 'flooding' precondition referenced in the description.

RemediationAI

Upgrade Pizzy Library to version 1.3.9.26250 or later, which is the first fixed release per the affected-range boundary in the advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0383. If immediate upgrade is not feasible, place the library behind a reverse proxy or API gateway that enforces per-account request-rate limits and connection quotas (trade-off: legitimate batch workloads may be throttled), and restrict authentication to a minimal trusted user set to shrink the attacker pool. Monitor for sustained request bursts from single authenticated identities and add alerting on resource saturation (CPU, thread pool, memory) tied to Pizzy Library processes.