CVE-2022-24685: HashiCorp Nomad - Allocation of Resources Without Limits or Throttling
Summary
CVE-2022-24685: HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling. Affects github.com/hashicorp/nomad across 3 version ranges.
>= 1.0.0, < 1.0.17
>= 1.1.0, < 1.1.12
>= 1.2.0, < 1.2.6
Fixed in 1.0.17, 1.1.12 or 1.2.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Nomad is an open-source job scheduler and cluster manager designed for microservices and batch processing workloads. It provides a platform for deploying and managing applications across a cluster of machines. Nomad is written in Go and is widely used in production environments. However, versions 1.x before 1.0.17, 1.1.x before 1.1.12, and 1.2.x before 1.2.6 are vulnerable to an Allocation of Resources Without Limits or Throttling issue.
Vulnerability Detail
The vulnerability in HashiCorp Nomad allows an attacker to allocate resources without any limits or throttling. This can lead to resource exhaustion, denial of service, and potential performance degradation. The issue arises due to a lack of proper resource allocation controls in the affected versions of Nomad. An attacker can exploit this vulnerability by submitting a large number of resource-intensive jobs or tasks, overwhelming the system and causing it to become unresponsive or crash.
How To Fix
Latest published version: v1.11.3 as of 22 Oct 2026
go get github.com/hashicorp/nomad@v1.11.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.0.171.0.17go get github.com/hashicorp/nomad@v1.0.17 -
>= 1.1.0, < 1.1.121.1.12go get github.com/hashicorp/nomad@v1.1.12 -
>= 1.2.0, < 1.2.61.2.6go get github.com/hashicorp/nomad@v1.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest patched version of HashiCorp Nomad.
Conclusion
The vulnerability in HashiCorp Nomad allows for the allocation of resources without limits or throttling, leading to resource exhaustion and potential denial of service. It is crucial to upgrade to the latest patched version of HashiCorp Nomad (1.0.17, 1.1.12, or 1.2.6) to mitigate the risk. Regularly updating Nomad is recommended to ensure the latest security patches are applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/nomad →
FAQ
HashiCorp Nomad is an open-source job scheduler and cluster manager designed for microservices and batch processing workloads. It provides a platform for deploying and managing applications across a cluster of machines.
The vulnerability allows an attacker to allocate resources without any limits or throttling, leading to resource exhaustion, denial of service, and potential performance degradation.
An attacker can exploit this vulnerability by submitting a large number of resource-intensive jobs or tasks, overwhelming the system and causing it to become unresponsive or crash.
No, only versions 1.x before 1.0.17, 1.1.x before 1.1.12, and 1.2.x before 1.2.6 are affected by this vulnerability.
No, there is no known workaround. It is crucial to upgrade to the latest patched version of HashiCorp Nomad.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/nomad.
