Hatchet CVE-2026-108755

Exploitation requires that the Hatchet SNS ingestion endpoint (POST /api/v1/sns/{tenant}/{event}) be network-reachable by the attacker; the instance must be running Hatchet 0.110.5 or earlier. No authentication, credentials, or valid tenant/UUID are needed - the handler accepts any UUID and buffers the body BEFORE signature verification, so the SNS signature check provides no protective limit. No user interaction or special non-default feature toggle is indicated. The primary limiting factor is network exposure: instances not reachable from untrusted networks (e.g., behind authenticated gateways, internal-only, or protected by an upstream request-size/rate limit) are not practically exploitable, and impact is confined to availability degradation rather than code execution or data exposure.

This is a moderate-severity availability-only issue, not a critical priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N, score 6.9) is internally consistent with the description: remote, network-reachable, no authentication (PR:N), no user interaction, and impact confined to partial availability (VA:L) with zero confidentiality or integrity effect - appropriate for CWE-770 resource exhaustion. All exploitation signals point to low urgency despite the network/unauthenticated profile: there is no CISA KEV listing and no EPSS score was supplied, so widespread automated exploitation cannot be inferred. A detailed public technical write-up (hackmd) and a VulnCheck advisory exist and pinpoint the vulnerable code path, which lowers the research barrier for an attacker, but this is NOT the same as published weaponized exploit code or confirmed active exploitation. No SSVC decision data was provided. Net: a genuine, easily-triggered denial-of-service against exposed Hatchet instances, but the impact ceiling is service degradation only - treat as a patch-in-normal-cycle issue unless the affected endpoint is internet-exposed and business-critical.

An attacker locates an internet-exposed Hatchet instance and sends large or highly concurrent HTTP POST requests to /api/v1/sns/{tenant}/{event} using any arbitrary UUID. Because the SnsUpdate handler buffers the full request body into memory before performing SNS signature verification, the unauthenticated requests accumulate memory until the service degrades or becomes unavailable. No public exploit code is identified, but a detailed technical write-up describing the exact flaw and code path is publicly available.