Medium severity5.3NVD Advisory· Published Oct 11, 2026· Updated Oct 11, 2026
CVE-2026-108755
CVE-2026-108755
Description
Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent request bodies to POST /api/v1/sns/{tenant}/{event} with any UUID, which the SnsUpdate handler buffers before signature verification, degrading availability.
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/hatchet-dev/hatchet/blob/56c617e0da399bc9d8a10d2ba74b4950f8a950b8/api/v1/server/handlers/ingestors/sns.gonvd
- github.com/hatchet-dev/hatchet/blob/56c617e0da399bc9d8a10d2ba74b4950f8a950b8/api/v1/server/middleware/ratelimit/ratelimit.gonvd
- hackmd.io/@haind03/hatchet-public-sns-unbounded-body-before-signature-dosnvd
- www.vulncheck.com/advisories/hatchet-through-0.110.5-unauthenticated-memory-exhaustion-via-sns-ingestion-endpointnvd
News mentions
0No linked articles in our index yet.