---
id: CVE-2026-108755
title: >-
  Hatchet through 0.110.5 contains an allocation of resources without limits
  vulnerability that allows unauthenticated attackers to exhaust memory via the
  SNS ingestion endpoint
summary: >-
  Hatchet through 0.110.5 contains an allocation of resources without limits
  vulnerability that allows unauthenticated attackers to exhaust memory via the
  SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent
  request b…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-770
published: '2026-10-11'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T17:18:21.473'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108755'
references:
  - url: 'https://github.com/hatchet-dev/hatchet'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/hatchet-dev/hatchet/blob/56c617e0da399bc9d8a10d2ba74b4950f8a950b8/api/v1/server/handlers/ingestors/sns.go#L15-L32
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/hatchet-dev/hatchet/blob/56c617e0da399bc9d8a10d2ba74b4950f8a950b8/api/v1/server/middleware/ratelimit/ratelimit.go#L33-L49
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@haind03/hatchet-public-sns-unbounded-body-before-signature-dos
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/hatchet-through-0.110.5-unauthenticated-memory-exhaustion-via-sns-ingestion-endpoint
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00315
epssPercentile: 0.24238
ingestedAt: '2026-10-11T13:51:17.040Z'
vendor: hatchet-dev
product: hatchet
affected:
  - hatchet <= 0.110.5
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-14T16:41:43.921802Z'
---

## Overview

Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent request bodies to POST /api/v1/sns/{tenant}/{event} with any UUID, which the SnsUpdate handler buffers before signature verification, degrading availability.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.