Moderate severityNVD Advisory· Published Oct 11, 2022· Updated May 20, 2025

CVE-2022-41606

Description

HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/hashicorp/nomadGo	< 1.2.13	1.2.13
github.com/hashicorp/nomadGo	>= 1.3.0, < 1.3.6	1.3.6

Affected products

Hashicorp/Nomadcpe-rescue
ghsa-coords
pkg:golang/github.com/hashicorp/nomad
Range: < 1.2.13

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-7v3g-4878-5qrfghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-41606ghsaADVISORY
discuss.hashicorp.comghsaWEB
discuss.hashicorp.com/t/hcsec-2022-22-nomad-panics-on-job-submission-with-bad-artifact-stanza-source-url/45420ghsaWEB
pkg.go.dev/vuln/GO-2022-1062ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000