CVE-2022-41606

HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0.

Score

CVSS 3.1 6.5 Medium

Status

Modified - cve@mitre.org

Published

2022-10-12

Last modified

2025-05-20

Weaknesses

CWE-20

Affected products

• Nomad (Hashicorp)

References

• https://discuss.hashicorp.com
• https://discuss.hashicorp.com/t/hcsec-2022-22-nomad-panics-on-job-submission-with-bad-artifact-stanza-source-url/45420