CVE-2026-108755mediumCWE-770

CVE-2026-108755: medium-severity vulnerability in hatchet-dev hatchet

Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint

Published · Updated

Follow this CVE+ Monitor hatchet

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.3%
Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent request bodies to POST /api/v1/sns/{tenant}/{event} with any UUID, which the SnsUpdate handler buffers before signature verification, degrading availability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
hatchet-dev · hatchet
Related CVEs — hatchet-dev hatchet

In the same product, most dangerous first.

CVE-2026-54746MEDIUMHatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and UnsubscribeEPSS 0.4%CVE-2026-63342MEDIUMHatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization CheckEPSS 0.3%CVE-2026-61681MEDIUMHatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation HandlerEPSS 0.3%CVE-2026-88978MEDIUMHatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filterEPSS 0.3%CVE-2026-84298LOWHatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 DispatcherEPSS 0.2%CVE-2026-42572MEDIUMHatchet: Cross-tenant information disclosure in `listTasksByDAGIds`EPSS 0.2%