Sonatype Nexus Security Advisory
Date: September 2, 2026
Affected Versions: Nexus Repository 3 CE/Pro versions 3.26 through 3.94.x
Fixed in Version: Nexus Repository 3 CE/Pro version 3.95.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N = 5.3 (Medium)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-77121
Summary
A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository’s components to permanently fail until an administrator repairs the underlying data. Only the targeted repository is affected; other repositories and overall server health remain unaffected. Sonatype is not aware of any active exploitation of this vulnerability.
Recommendation
Upgrade to Nexus Repository 3 CE/Pro version 3.95.0 or later. Downloads are available at https://help.sonatype.com/en/download.html
Credit
This issue was discovered and reported responsibly by e0x1337 (elite) via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An attacker who can deploy artifacts to a hosted Maven repository can permanently break that repository’s component listing and browse functionality, requiring administrator intervention to recover.
Q: What preconditions must be met in order to be vulnerable?
A: The attacker must hold an account with permission to deploy artifacts to a hosted Maven repository.
Q: Are there implications associated with this advisory itself?
A: As with any vulnerability disclosure, publishing details about this issue could give malicious actors information they could use to attempt exploitation. Sonatype recommends customers assess their exposure and apply the fix promptly.
Q: Why is Sonatype making this information available?
A: Sonatype follows a responsible disclosure process and proactively notifies customers of security issues so they can take appropriate action to protect their systems.