Resource Exhaustion Vulnerability in Hatchet by Hatchet Dev
CVE-2026-108755
6.9MEDIUM
What is CVE-2026-108755?
Hatchet versions prior to 0.110.6 are susceptible to a resource exhaustion vulnerability that permits unauthenticated attackers to deplete system memory through the SNS ingestion endpoint. The flaw arises when attackers send excessively large or numerous request bodies to the API endpoint /api/v1/sns/{tenant}/{event}. This action leads to the SnsUpdate handler buffering the requests prior to undergoing signature verification, which can result in a significant degradation of service availability.
Affected Version(s)
hatchet 0 <= 0.110.5
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology