---
id: CVE-2026-108755
title: >-
  Hatchet through 0.110.5 contains an allocation of resources without limits
  vulnerability that allows unauthenticated attackers to exhaust memory via the
  SNS ingestion endpoint
summary: >-
  Hatchet through 0.110.5 contains an allocation of resources without limits
  vulnerability that allows unauthenticated attackers to exhaust memory via the
  SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent
  request b…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-770
published: '2026-10-11'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T13:17:20.633'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108755'
references:
  - url: 'https://github.com/hatchet-dev/hatchet'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/hatchet-dev/hatchet/blob/56c617e0da399bc9d8a10d2ba74b4950f8a950b8/api/v1/server/handlers/ingestors/sns.go#L15-L32
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/hatchet-dev/hatchet/blob/56c617e0da399bc9d8a10d2ba74b4950f8a950b8/api/v1/server/middleware/ratelimit/ratelimit.go#L33-L49
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@haind03/hatchet-public-sns-unbounded-body-before-signature-dos
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/hatchet-through-0.110.5-unauthenticated-memory-exhaustion-via-sns-ingestion-endpoint
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-11T13:51:17.040Z'
---

## Overview

Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent request bodies to POST /api/v1/sns/{tenant}/{event} with any UUID, which the SnsUpdate handler buffers before signature verification, degrading availability.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.