CVE-2026-70489

The vulnerability in this recurrence scheduler isn't a clever exploitation—it's an architectural trap that turned a reasonable implementation choice into an availability failure. The core issue: a date-walking algorithm anchored at 2000-01-01 walks forward to find the next occurrence of a recurrence rule. For MINUTELY frequency, that walk is computationally unbounded. Worse, the scheduler recomputes this for every claimed row in the queue, multiplying a slow operation by queue depth with no circuit breaker in the event loop. The 2000-01-01 anchor was defensible when written—the developer was implementing textbook RFC 5545 recurrence enumeration, where anchored rules need a reference point. But the framework gave them no mechanism to enforce bounds alongside correctness. The trap wasn't a bad decision; it was the absence of any guardrail that would make unbounded iteration visible during code review. What makes this structural rather than incidental: the architecture treats recurrence computation as a stateless pure function that gets recomputed on every poll rather than stored as mutable state. This is elegant, testable, and avoids consistency bugs—but it conceals a computational trap. The developer had no reason to suspect they were inside a loop-within-a-loop because the outer loop lives in a different file, written by a different team. The failure only emerges at the intersection of specific rule configurations and production load patterns that staging never exercises. For defenders: audit any code path that walks recurrence rules forward from a fixed anchor point without an iteration cap. Add explicit bounds on enumeration steps regardless of rule validity. Treat recurrence computation as a distinct concern that requires resource policy enforcement—not just correct logic, but bounded logic. The EPSS score is low because this doesn't require an attacker; it requires a product manager who thought MINUTELY was a reasonable feature request. The blast radius is other tenants on shared infrastructure losing availability because someone in the next cubicle tested a recurrence rule. That's a different risk category than CVSS captures.

Reviewed through automated stages and approved by a human before publication.