CVE-2026-77121CWE-770denial-of-service

CVE-2026-77121

Medium · published September 2, 2026

CVSS v3.1

6.5

EPSS

Percentile

16.1

In the wild

Unconfirmed

What it is

A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only the targeted repository is affected; other repositories and overall server health remain unaffected.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: 5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS: 0.00254 · 16.1th percentile
Weakness: CWE-770 · Allocation of Resources Without Limits or Throttling
Published: 2026-09-02T22:21Z

Affected products (1)

Product	Versions	Fixed in
sonatype/nexus_repository_manager	≥ 3.26.0, < 3.95.0	3.95.0

References (2)

https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html · 103e4ec9-0a87-450b-af77-479448ddef11 https://support.sonatype.com/hc/en-us/articles/54635665756691/ · 103e4ec9-0a87-450b-af77-479448ddef11

EPSS history

Timeline

04 SEP 03:44Z
EPSS moved — → 0%
epss
02 SEP 17:03Z
Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields
cvelistv5