Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-108755 · Microsoft / collected KEV context

cve-program · CVE-2026-108755

• https://hackmd.io/@haind03/hatchet-public-sns-unbounded-body-before-signature-dos
• https://github.com/hatchet-dev/hatchet/blob/56c617e0da399bc9d8a10d2ba74b4950f8a950b8/api/v1/server/handlers/ingestors/sns.go#L15-L32
• https://github.com/hatchet-dev/hatchet/blob/56c617e0da399bc9d8a10d2ba74b4950f8a950b8/api/v1/server/middleware/ratelimit/ratelimit.go#L33-L49
• https://github.com/hatchet-dev/hatchet
• https://www.vulncheck.com/advisories/hatchet-through-0.110.5-unauthenticated-memory-exhaustion-via-sns-ingestion-endpoint

No related operational record is retained in the current change model.