CVE-2022-24685

HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling

7.5 HighFix available

HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0.18, 1.1.12, and 1.2.6.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.55%Up 0.7 points since Mar 1, 2022

What each source reports

NVD Score used 7.5

HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0.18, 1.1.12, and 1.2.6.

Record: CVE-2022-24685
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-770
Updated: 2026-11-02

CVE List No score

HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0.18, 1.1.12, and 1.2.6.

Record: CVE-2022-24685
Updated: 2026-11-02

EUVDEUVD-2022-1281 No score

HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0.18, 1.1.12, and 1.2.6.

Record: EUVD-2022-1281
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3382-r9q8-4hfg 7.5

HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling

HashiCorp Nomad and Nomad Enterprise 1.x before 1.0.17, 1.1.x before 1.1.12, and 1.2.x before 1.2.6 is vulnerable to Allocation of Resources Without Limits or Throttling.

Record: GHSA-3382-r9q8-4hfg
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

OSVALPINE-CVE-2022-24685 7.5

HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0.18, 1.1.12, and 1.2.6.

Record: ALPINE-CVE-2022-24685
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSVGHSA-3382-r9q8-4hfg 7.5

HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling

HashiCorp Nomad and Nomad Enterprise 1.x before 1.0.17, 1.1.x before 1.1.12, and 1.2.x before 1.2.6 is vulnerable to Allocation of Resources Without Limits or Throttling.

Record: GHSA-3382-r9q8-4hfg
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-24685 7.5

HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0.18, 1.1.12, and 1.2.6.

Record: UBUNTU-CVE-2022-24685
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV No score

HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0.18, 1.1.12, and 1.2.6.

Record: CVE-2022-24685
Updated: 2026-11-02

OSVGO-2022-0577 No score

HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling in github.com/hashicorp/nomad

HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling in github.com/hashicorp/nomad

Record: GO-2022-0577
Updated: 2026-11-02

Affected products

hashicorp nomad

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/hashicorp/nomad` Go	1.0.0 up to 1.0.17	1.0.17
`github.com/hashicorp/nomad` Go	1.1.0 up to 1.1.12	1.1.12
`github.com/hashicorp/nomad` Go	1.2.0 up to 1.2.6	1.2.6
`nomad` Alpine:v3.15	1.0.0 up to 1.1.12-r0	1.1.12-r0
`nomad` Alpine:v3.16	1.0.0 up to 1.2.6-r0	1.2.6-r0
`nomad` Alpine:v3.17	1.0.0 up to 1.2.6-r0	1.2.6-r0
`nomad` Alpine:v3.18	1.0.0 up to 1.2.6-r0	1.2.6-r0
`github.com/hashicorp/nomad` Go	1.0.0 up to 1.0.17, 1.1.0 up to 1.1.12, 1.2.0 up to 1.2.6	1.0.171.1.121.2.6
`nomad` Ubuntu:18.04:LTS	All versions, plus listed versions 0.4.0+dfsg-1	None known
`nomad` Ubuntu:20.04:LTS	All versions, plus listed versions 0.8.7+dfsg1-1ubuntu1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-24685 is a high vulnerability (CVSS 7.5) in Hashicorp Nomad, published February 28, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.55%, the 75th percentile. Fixed in github.com/hashicorp/nomad 1.0.17.

References

Show 4 moreShow less