CVE-2020-7218: HashiCorp Nomad - Allocation of Resources Without Limits or Throttling
Summary
CVE-2020-7218: Allocation of Resources Without Limits or Throttling in HashiCorp Nomad. Affects github.com/hashicorp/nomad versions < 0.10.3. Fixed in 0.10.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Nomad is a scheduling and orchestration tool used for deploying and managing applications across a cluster of machines. It is written in Go and provides a flexible and scalable solution for workload management. However, versions prior to 0.10.3 are vulnerable to an issue that allows unbounded resource usage.
Vulnerability Detail
The vulnerability in HashiCorp Nomad and Nomad Enterprise before 0.10.3 allows for the allocation of resources without any limits or throttling. This means that an attacker can exploit this vulnerability to consume excessive resources, potentially leading to denial of service (DoS) attacks or resource exhaustion. The lack of resource controls can result in degraded performance and availability of the Nomad system.
How To Fix
Latest published version: v1.11.3 as of 22 Oct 2026
go get github.com/hashicorp/nomad@v1.11.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.10.3
This is the first release that contains the fix.
go get github.com/hashicorp/nomad@v0.10.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the patched version of HashiCorp Nomad to mitigate the risk of resource abuse.
Conclusion
The vulnerability in HashiCorp Nomad allows for unbounded resource usage, which can lead to denial of service (DoS) attacks or resource exhaustion. To mitigate this risk, it is crucial to upgrade to HashiCorp Nomad version 0.10.3 or later. This version includes the necessary patches and improvements to address the resource allocation issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/nomad →
FAQ
HashiCorp Nomad is a scheduling and orchestration tool used for deploying and managing applications across a cluster of machines. It provides a flexible and scalable solution for workload management.
The vulnerability allows for unbounded resource usage, which can lead to denial of service (DoS) attacks or resource exhaustion. It can result in degraded performance and availability of the Nomad system.
To fix this vulnerability, upgrade to HashiCorp Nomad version 0.10.3 or later. This version includes the necessary patches and improvements to address the resource allocation issue.
There is no known workaround for this vulnerability. It is crucial to upgrade to the patched version of HashiCorp Nomad to mitigate the risk of resource abuse.
For more information about this vulnerability, you can refer to the official HashiCorp Nomad documentation or contact the HashiCorp support team.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/nomad.
