CVE-2026-108755 Details

A vulnerability allowing unauthenticated memory exhaustion has been identified in Hatchet versions through 0.110.5. This issue arises from the SNS ingestion endpoint, where the SnsUpdate handler buffers request bodies without size limits before performing signature verification. As a result, attackers can send excessively large or concurrent requests, leading to degraded availability.

To address this vulnerability, the SNS ingestion handler should be modified to include a bounded read of the request body, using 'io.LimitReader' to cap the size at a safe limit, such as 256 KiB. Additionally, the 'x-enable-rate-limiting' extension should be added to the SNS operation in the OpenAPI contract to allow the general API rate limiter to throttle repeated calls. These changes should be accompanied by a regression test to ensure that over-limit bodies are properly rejected before reaching the handler.