CVE-2026-77121

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77121
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77121.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-77121
Downstream
MINI (2)
Published
2026-09-02T17:03:26Z
Modified
2026-10-09T02:49:30Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields
Details

A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only the targeted repository is affected; other repositories and overall server health remain unaffected.

Database specific 
{
    "cna_assigner": "Sonatype",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77121.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "3.26.0"
                },
                {
                    "fixed": "3.95.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/sonatype/nexus-public

Affected ranges

Type
GIT
Repo
https://github.com/sonatype/nexus-public
Events
Introduced
6bd0470a879222218cbad765023d317d36fc1e0c
Fixed
e1778b02409c1d89a2ac005f44280a23c30520d5
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:sonatype:nexus_repository_manager:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.26.0"
        },
        {
            "fixed": "3.95.0"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

3.*
3.37.1-01
release-3.*
release-3.26.0-04
release-3.26.1-02
release-3.27.0-03
release-3.28.0-01
release-3.28.1-01
release-3.29.0-02
release-3.29.1-01
release-3.29.2-02
release-3.30.0-01
release-3.30.1-01
release-3.31.0-01
release-3.31.1-01
release-3.32.0-03
release-3.33.0-01
release-3.33.1-01
release-3.34.0-01
release-3.34.1-01
release-3.35.0-02
release-3.36.0-01
release-3.37.0-01
release-3.37.3-02
release-3.38.0-01
release-3.38.1-01
release-3.39.0-01
release-3.40.0-03
release-3.41.0-01
release-3.41.1-01
release-3.42.0-01
release-3.43.0-01
release-3.44.0-01
release-3.45.0-01
release-3.45.1-SNAPSHOT
release-3.46.0-01
release-3.47.0-01
release-3.47.1-01
release-3.48.0-01
release-3.49.0-02
release-3.50.0-01
release-3.51.0-01
release-3.52.0-01
release-3.53.0-01
release-3.53.1-02
release-3.54.1-01
release-3.55.0-01
release-3.56.0-01
release-3.57.0-01
release-3.58.0-01
release-3.58.1-01
release-3.58.1-02
release-3.59.0-01
release-3.60.0-02
release-3.61.0-02
release-3.62.0-01
release-3.63.0-01
release-3.64.0-03
release-3.64.0-04
release-3.65.0-02
release-3.66.0-02
release-3.67.0-03
release-3.67.1-01
release-3.68.0-04
release-3.68.1-02
release-3.69.0-02
release-3.70.0-03
release-3.70.1-02
release-3.71.0-06
release-3.72.0-04
release-3.73.0-12
release-3.74.0-05
release-3.75.0-06
release-3.75.1-01
release-3.76.0-03
release-3.76.1-01
release-3.77.0-08
release-3.77.1-01
release-3.77.2-02
release-3.78.0-14
release-3.78.1-02
release-3.78.2-04
release-3.79.0-09
release-3.79.1-04
release-3.80.0-06
release-3.81.0-08
release-3.81.1-01
release-3.82.0-08
release-3.83.0-08
release-3.83.1-03
release-3.83.2-01
release-3.84.0-03
release-3.84.1-01
release-3.85.0-03
release-3.86.0-08
release-3.86.2-01
release-3.87.0-03
release-3.87.1-01
release-3.88.0-08
release-3.89.0-09
release-3.89.1-02
release-3.90.0-21
release-3.91.0-07
release-3.91.1-04
release-3.92.1-05
release-3.92.2-01
release-3.92.3-01
release-3.93.0-06
release-3.93.1-04
release-3.93.2-01
release-3.94.0-12
release-3.94.1-06

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77121.json"