CVE-2026-108755mediumCWE-770

CVE-2026-108755: fallo de gravedad media en hatchet-dev hatchet

Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear hatchet

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.9epss 0.3%
Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent request bodies to POST /api/v1/sns/{tenant}/{event} with any UUID, which the SnsUpdate handler buffers before signature verification, degrading availability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Productos afectados
hatchet-dev · hatchet
CVEs relacionadas — hatchet-dev hatchet

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-54746MEDIUMHatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and UnsubscribeEPSS 0.4%CVE-2026-63342MEDIUMHatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization CheckEPSS 0.3%CVE-2026-61681MEDIUMHatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation HandlerEPSS 0.3%CVE-2026-88978MEDIUMHatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filterEPSS 0.3%CVE-2026-84298LOWHatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 DispatcherEPSS 0.2%CVE-2026-42572MEDIUMHatchet: Cross-tenant information disclosure in `listTasksByDAGIds`EPSS 0.2%