CVE-2022-41606: Hashicorp Nomad

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0.

Affected products

• Hashicorp Nomad: from 1.0.2, before 1.2.13 (fixed in 1.2.13); from 1.3.0, before 1.3.6 (fixed in 1.3.6)

Published 2022-10-12. Last modified 2026-06-17.