Medium severity · published Sep 2, 2026
CVE-2026-77121
Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only the targeted repository is affected; other repositories and overall server health remain unaffected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NR
Nexus Repository 3 · Sonatype
3.26.0 before 3.95.0 · source: vendor
NR
Nexus Repository Manager · Sonatype
3.26.0 before 3.95.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77121
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77121
Release Notes
https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html
Permissions Required
https://support.sonatype.com/hc/en-us/articles/54635665756691/
More from Nexus Repository 3
9.8
CVE-2019-7238
Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability
9.8
CVE-2026-5189
Nexus Repository 3 - Hardcoded Credential in Internal Database Component
9.8
CVE-2019-9629
Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials)
9.8
CVE-2017-17717
Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature
8.8
CVE-2026-17600
Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation