Unauthenticated memory exhaustion in Hatchet via SNS ingestion endpoint
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.
Summary
Hatchet through 0.110.5 is affected by an allocation of resources without limits flaw in its SNS ingestion endpoint (CWE-770). An unauthenticated remote attacker can exhaust server memory by sending arbitrarily large or concurrent request bodies to POST /api/v1/sns/{tenant}/{event} with any UUID. The SnsUpdate handler buffers these bodies before signature verification, which degrades availability.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent request bodies to POST /api/v1/sns/{tenant}/{event} with any UUID, which the SnsUpdate handler buffers before signature verification, degrading availability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| hatchet-dev | hatchet | up to 0.110.5 | — | No fix listed | CNA |
- hatchet Vendorhatchet-dev Affected up to 0.110.5 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Hatchet.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108755
- 2026-10-11 Alias added: GHSA-pjjx-3frh-55ch
- 2026-10-12 Priority changed: MEDIUM → LOW
- 2026-10-15 CISA SSVC decision points changed
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 3
- https://github.com/hatchet-dev/hatchet/blob/56c617e0da399bc9d8a10d2ba74b4950f8a950b8/api/v1/server/handlers/ingestors/sns.go#L15-L32
- https://github.com/hatchet-dev/hatchet/blob/56c617e0da399bc9d8a10d2ba74b4950f8a950b8/api/v1/server/middleware/ratelimit/ratelimit.go#L33-L49
- https://github.com/hatchet-dev/hatchet
More hatchet-dev vulnerabilities
- TI-2026-44164 hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState CVSS 3.1HIGH 7.1
- TI-2026-39557 Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe CVSS 3.1MEDIUM 6.4
- TI-2026-45168 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check CVSS 3.1MEDIUM 6.3
- TI-2026-60309 Authorization bypass in hatchet-dev hatchet CVSS 3.1MEDIUM 4.3
- TI-2026-44159 Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler CVSS 3.1MEDIUM 4.1
- TI-2026-57935 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher CVSS 3.1LOW 3.1
Sources
- CVE-2026-108755 · CVE Program
- CVE-2026-108755 · NVD
- FIRST EPSS
- GHSA-pjjx-3frh-55ch · GitHub Advisory Database · CC BY 4.0
- CVE-2026-108755 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences