CVE-2022-24684
MEDIUMHashiCorp Nomad 0.9.0-1.0.16 1.1.11 1.2.5 - Denial of Service via Spread Job Stanza
Title source: llmDescription
HashiCorp Nomad and Nomad Enterprise 0.9.0 through 1.0.16, 1.1.11, and 1.2.5 allow operators with job-submit capabilities to use the spread stanza to panic server agents. Fixed in 1.0.18, 1.1.12, and 1.2.6.
References (4)
Core 4
Core References
Vendor Advisory x_refsource_misc
https://discuss.hashicorp.com
Vendor Advisory x_refsource_misc
https://discuss.hashicorp.com/t/hcsec-2022-04-nomad-spread-job-stanza-may-trigger-panic-in-servers/35562
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20220318-0008/
Various Sources x_refsource_misc
https://discuss.hashicorp.com/t/hcsec-2022-04-nomad-spread-job-stanza-may-trigger-panic-in-servers/
Scores
CVSS v3
6.5
EPSS
0.0067
EPSS Percentile
71.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Details
Status
published
Products (2)
hashicorp/nomad
0.9.0 - 1.0.18 (2 CPE variants)
hashicorp/nomad
0.9.0 - 1.0.18Go
Published
Feb 15, 2022
Tracked Since
Feb 18, 2026