CVE-2026-108755 hatchet-dev CVE debrief

Who should care

Defenders responsible for Hatchet deployments should assess exposure and prioritize patching or mitigation to prevent memory exhaustion attacks. This includes verifying the Hatchet version, applying patches or mitigations, and monitoring for suspicious activity on the endpoint. Security teams and vulnerability management teams should also review the vulnerability and implement compensating controls for exposed systems.

Why it matters

CVE-2026-108755 is a medium-severity vulnerability in Hatchet that allows unauthenticated memory exhaustion via the SNS ingestion endpoint. Defenders should prioritize verifying the Hatchet version and applying patches or mitigations to prevent memory exhaustion attacks.

• Memory exhaustion can lead to denial of service
• Unauthenticated attackers can exploit the vulnerability
• Verification of Hatchet version and patching is necessary

Technical summary

The vulnerability is due to the allocation of resources without limits in Hatchet versions up to 0.110.5, which can be exploited by sending large or concurrent request bodies to the POST /api/v1/sns/{tenant}/{event} endpoint. This allows unauthenticated attackers to cause memory exhaustion, degrading availability. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity. Defenders should prioritize verifying the Hatchet version and applying patches or mitigations to prevent memory exhaustion attacks.

Defensive priority

Defenders should prioritize verifying the Hatchet version and applying patches or mitigations to prevent memory exhaustion attacks.

Recommended defensive actions

• Verify Hatchet version and apply patches or mitigations
• Implement rate limiting on SNS ingestion endpoint
• Monitor for suspicious activity on the endpoint
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions. Defenders should verify the Hatchet version and apply patches or mitigations to prevent memory exhaustion attacks. The vulnerability allows unauthenticated attackers to cause memory exhaustion via the SNS ingestion endpoint. Evidence is limited to public CVE and source item descriptions. No additional facts are assumed. Verify Hatchet version and apply patches or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.