CVE-2026-77121

UNKNOWN 0.0

Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only the targeted repository is affected; other repositories and overall server health remain unaffected.

CWE	CWE-770
Vendor	sonatype
Product	nexus repository 3
Published	Sep 2, 2026
Last Updated	Sep 2, 2026

Stay Ahead of the Next One

Get instant alerts for sonatype nexus repository 3

Be the first to know when new unknown vulnerabilities affecting sonatype nexus repository 3 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Sonatype / Nexus Repository 3

3.26.0 < 3.95.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

help.sonatype.com: https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html support.sonatype.com: https://support.sonatype.com/hc/en-us/articles/54635665756691/

Credits

e0x1337 (elite)