CVE-2026-108755: Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint
Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent request bodies to POST /api/v1/sns/{tenant}/{event} with any UUID, which the SnsUpdate handler buffers before signature verification, degrading availability.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker able to reach the SNS ingestion endpoint can send requests to it. The tenant and event path values can use any UUID, so valid tenant-specific identifiers are not required.
What endpoint and request behavior trigger the availability impact?
The affected endpoint is POST /api/v1/sns/{tenant}/{event}. An attacker can submit arbitrarily large request bodies or many concurrent requests, causing the handler to buffer request data before verifying its signature and exhausting memory.
Is a valid SNS signature required to cause the problem?
No. Request bodies are buffered before signature verification, so invalid or unsigned requests can consume memory.
How can I determine whether an instance may be affected?
Instances running Hatchet through version 0.110.5 may be affected if the SNS ingestion endpoint is reachable by an attacker. Signs of active exploitation would include unusually large or highly concurrent POST requests to /api/v1/sns/{tenant}/{event} together with memory pressure or degraded availability.