CVE-2022-24684: Nomad Spread Job Stanza May Trigger Panic in Servers
Summary
CVE-2022-24684: Nomad Spread Job Stanza May Trigger Panic in Servers. Affects github.com/hashicorp/nomad across 3 version ranges.
>= 0.9.0, < 1.0.18
>= 1.1.0, < 1.1.12
>= 1.2.0, < 1.2.6
Fixed in 1.0.18, 1.1.12 or 1.2.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nomad is an open-source cluster manager and scheduler designed for microservices and batch workloads. It allows operators to deploy and manage applications across a cluster of servers. Nomad uses the spread stanza to distribute jobs across multiple servers for load balancing and fault tolerance. However, a vulnerability in Nomad's spread stanza can be exploited by operators with job-submit capabilities to cause panic in Nomad servers.
Vulnerability Detail
The vulnerability, identified as CVE-2022-24684, arises from improper usage of the spread stanza in Nomad. By crafting a malicious job submission, an attacker can trigger a panic in Nomad servers. This can lead to service disruption, denial of service, and potential data loss. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: v1.11.3 as of 22 Oct 2026
go get github.com/hashicorp/nomad@v1.11.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.9.0, < 1.0.181.0.18go get github.com/hashicorp/nomad@v1.0.18 -
>= 1.1.0, < 1.1.121.1.12go get github.com/hashicorp/nomad@v1.1.12 -
>= 1.2.0, < 1.2.61.2.6go get github.com/hashicorp/nomad@v1.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update Nomad to the fixed versions.
Conclusion
The vulnerability in Nomad's spread stanza can be exploited to trigger panic in Nomad servers, potentially leading to service disruption and data loss. It is crucial for operators to update their Nomad installations to the fixed versions (1.0.18, 1.1.12, or 1.2.6) to mitigate this vulnerability. For further support and assistance in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/nomad →
FAQ
Nomad is an open-source cluster manager and scheduler designed for microservices and batch workloads. It provides a platform for deploying and managing applications across a cluster of servers.
The spread stanza in Nomad is used to distribute jobs across multiple servers for load balancing and fault tolerance. It ensures that tasks are spread evenly across the cluster to optimize resource utilization and improve application availability.
Operators using Nomad versions prior to 1.0.18, 1.1.12, or 1.2.6 are affected by this vulnerability. If spread stanzas are used in job submissions, an attacker with job-submit capabilities can exploit this vulnerability.
Exploiting this vulnerability can lead to panic in Nomad servers, causing service disruption, denial of service, and potential data loss. It is crucial to update Nomad to the fixed versions to mitigate these risks.
To update Nomad, follow the official documentation provided by HashiCorp, the maintainers of Nomad. The documentation will guide you through the process of upgrading your Nomad installation to the recommended versions.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/nomad.
