Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint
Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent request bodies to POST /api/v1/sns/{tenant}/{event} with any UUID, which the SnsUpdate handler buffers before signature verification, degrading availability.
CVE-2026-108755
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-108755
hatchet
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/hatchet-dev/hatchet",
"vendor": "hatchet-dev",
"product": "hatchet",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver",
"lessThanOrEqual": "0.110.5"
}
],
"packageURL": "pkg:github/hatchet-dev/hatchet",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-108755
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #22281 · Revision 1
- Added to Heist Feed
- Publisher date