{"schema_version":"1","data":[{"id":22281,"advisory_id":"21b4eee9-465f-4909-92e5-03353e33e2b1","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108755","source_published_at":"2026-10-11T12:19:53.976+00:00","published_at":"2026-10-25T05:59:32.380568+00:00","extraction_method":"structured","technologies":["core-cve","hatchet"],"cve_ids":["CVE-2026-108755"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint","summary":"Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent request bodies to POST /api/v1/sns/{tenant}/{event} with any UUID, which the SnsUpdate handler buffers before signature verification, degrading availability.","evidence":"cve:CVE-2026-108755","products":[{"name":{"value":"hatchet","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-108755","aliases":["CVE-2026-108755"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/hatchet-dev/hatchet","vendor":"hatchet-dev","product":"hatchet","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"0.110.5"}],"packageURL":"pkg:github/hatchet-dev/hatchet","defaultStatus":"unaffected"}],"modified":"2026-10-14T16:41:59.714Z","provider":"cve","references":["https://hackmd.io/@haind03/hatchet-public-sns-unbounded-body-before-signature-dos","https://github.com/hatchet-dev/hatchet/blob/56c617e0da399bc9d8a10d2ba74b4950f8a950b8/api/v1/server/handlers/ingestors/sns.go#L15-L32","https://github.com/hatchet-dev/hatchet/blob/56c617e0da399bc9d8a10d2ba74b4950f8a950b8/api/v1/server/middleware/ratelimit/ratelimit.go#L33-L49","https://github.com/hatchet-dev/hatchet","https://www.vulncheck.com/advisories/hatchet-through-0.110.5-unauthenticated-memory-exhaustion-via-sns-ingestion-endpoint"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-108755","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T16:41:43.921802Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T16:41:59.714Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-11T12:19:53.976Z"}}},"related_cves":[{"value":"CVE-2026-108755","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"context_update":false},{"id":3484,"advisory_id":"d028f155-93b1-4632-87b0-b5d5984c45b7","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63342","source_published_at":"2026-09-21T15:44:07.494+00:00","published_at":"2026-10-24T21:36:02.891946+00:00","extraction_method":"structured","technologies":["core-cve","hatchet"],"cve_ids":["CVE-2026-63342"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check","summary":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task} endpoint implemented by listDurableEventLog without requiring the target tenant as a parent resource, allowing an authenticated user who obtains another tenant's durable task UUID to read that task's event log. Disclosed data can include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information. This issue is fixed in version 0.91.1.","evidence":"cve:CVE-2026-63342","products":[{"name":{"value":"hatchet","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-63342","aliases":["CVE-2026-63342"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"hatchet-dev","product":"hatchet","versions":[{"status":"affected","version":"< 0.91.1"}]}],"modified":"2026-09-29T15:02:14.543Z","provider":"cve","references":["https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-g26x-m427-f48f","https://github.com/hatchet-dev/hatchet/commit/06c1fe43543e853ea98ecc2e6a575e2b8310bbeb"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63342","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T15:02:05.214884Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T15:02:14.543Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T15:44:07.494Z"}}},"related_cves":[{"value":"CVE-2026-63342","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"context_update":false},{"id":1949,"advisory_id":"04ef3593-f907-4d51-bf3c-77664b55c7d8","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-88978","source_published_at":"2026-09-21T15:49:12.735+00:00","published_at":"2026-10-24T21:10:43.276552+00:00","extraction_method":"structured","technologies":["core-cve","hatchet"],"cve_ids":["CVE-2026-88978"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter","summary":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant's durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.","evidence":"cve:CVE-2026-88978","products":[{"name":{"value":"hatchet","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-88978","aliases":["CVE-2026-88978"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"hatchet-dev","product":"hatchet","versions":[{"status":"affected","version":"< 0.106.1"}]}],"modified":"2026-09-24T22:18:16.195Z","provider":"cve","references":["https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-992g-9cr3-vm5x","https://github.com/hatchet-dev/hatchet/commit/15bc7923d3a8ebfeb0d88c19160dd24828921e85"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-88978","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T22:18:07.030391Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:18:16.195Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T15:49:12.735Z"}}},"related_cves":[{"value":"CVE-2026-88978","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"context_update":false},{"id":1945,"advisory_id":"9f6aa196-b17c-4a8c-a535-ffe6d4b384b4","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61681","source_published_at":"2026-09-21T15:42:21.803+00:00","published_at":"2026-10-24T21:10:40.755023+00:00","extraction_method":"structured","technologies":["core-cve","hatchet"],"cve_ids":["CVE-2026-61681"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler","summary":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.","evidence":"cve:CVE-2026-61681","products":[{"name":{"value":"hatchet","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-61681","aliases":["CVE-2026-61681"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":4.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"hatchet-dev","product":"hatchet","versions":[{"status":"affected","version":"< 0.91.1"}]}],"modified":"2026-09-24T22:17:06.909Z","provider":"cve","references":["https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-fjwv-jf2v-j499","https://github.com/hatchet-dev/hatchet/commit/2d211bce16e5022afaf95780de82dc30e0bcba98"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-61681","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T22:16:56.469427Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:17:06.909Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T15:42:21.803Z"}}},"related_cves":[{"value":"CVE-2026-61681","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"context_update":false}],"next_after":22281,"next_before":1945}