Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2020-7218: HashiCorp Nomad can be overwhelmed, causing service drop
CVE-2020-7218 · published 6 years ago
Summary
Versions of HashiCorp Nomad up through 0.10.2 let anyone send unlimited requests, which can consume all resources and stop the service from working. This can make your scheduling system unavailable. Upgrade to version 0.10.3 or later to add limits that stop this from happening.
What to do
- Update github.com hashicorp to version 0.10.3.
- Update hashicorp nomad to version 0.10.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | hashicorp |
< 0.10.3 Fix: upgrade to 0.10.3
|
| – | hashicorp | nomad |
< 0.10.3 cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:* |
Original advisory text
Allocation of Resources Without Limits or Throttling in HashiCorp Nomad
HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 0.10.3.
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-7218
- https://github.com/hashicorp/nomad/pull/7022
- https://github.com/advisories/GHSA-h43v-26r7-7j4c
- https://github.com/hashicorp/nomad/issues/7002 Issue Tracking Mitigation Third Party Advisory
- https://www.hashicorp.com/blog/category/nomad/ Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-400Uncontrolled Resource Consumption
CWE-770Allocation of Resources Without Limits
Timeline
Published31 Jan 2020
Updated31 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta