Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108755Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint

Medium 5.3

In plain English

A medium-severity resource allocation without limits in hatchet from hatchet-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 75.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent request bodies to POST /api/v1/sns/{tenant}/{event} with any UUID, which the SnsUpdate handler buffers before signature verification, degrading availability.

Affected products (as reported)

Vendor	Product	Versions
hatchet-dev	hatchet	0 – through 0.110.5

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://hackmd.io/@haind03/hatchet-public-sns-unbounded-body-before-signature-dos third-party-advisory
https://github.com/hatchet-dev/hatchet/blob/56c617e0da399bc9d8a10d2ba74b4950f8a950b8/api/v1/server/handlers/ingestors/sns.go#L15-L32 technical-description
https://github.com/hatchet-dev/hatchet/blob/56c617e0da399bc9d8a10d2ba74b4950f8a950b8/api/v1/server/middleware/ratelimit/ratelimit.go#L33-L49 technical-description
https://github.com/hatchet-dev/hatchet product
VulnCheck Advisory: Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint third-party-advisory