CVE-2026-77121: Maven Repository DOS Vulnerability

CVE-2026-77121 Overview

CVE-2026-77121 is a denial-of-service vulnerability affecting Sonatype Nexus Repository. An authenticated user with permission to deploy artifacts to a hosted Maven repository can upload a Project Object Model (POM) file that contains an oversized metadata field. Once ingested, subsequent attempts to list or browse the affected repository's components fail persistently until an administrator repairs the underlying data.

The issue is scoped to the targeted repository. Other repositories on the same server, and overall server health, remain unaffected. The weakness is classified as [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
A single malicious POM upload renders component listing and browsing in the targeted Maven repository permanently unavailable until administrator remediation.

Affected Products

Sonatype Nexus Repository (hosted Maven repositories)
Versions prior to Sonatype Nexus Repository 3.95.0
Deployments permitting authenticated artifact deploy roles

Discovery Timeline

2026-09-02 - CVE CVE-2026-77121 published to the National Vulnerability Database
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-77121

Vulnerability Analysis

The vulnerability resides in the way Sonatype Nexus Repository parses and persists Maven POM metadata during artifact deployment. The server accepts arbitrary sizes for specific metadata fields without applying an upper bound. When downstream operations attempt to read that metadata to render component listings, the oversized field causes those operations to fail.

Because the malformed data is persisted on disk, the failure is durable. Restarting the service does not clear the condition. An administrator must repair the stored data before browsing functionality returns for the affected repository.

Exploitation requires an authenticated account with deploy privileges on a hosted Maven repository. No user interaction is required, and the attack is executed over the network via the standard Maven publish workflow.

Root Cause

The root cause is missing input size validation on POM metadata fields prior to storage, aligning with [CWE-770]. The absence of throttling or bounds checking allows a single upload to exhaust the assumptions of the component-listing subsystem, producing a persistent parse or read failure.

Attack Vector

An authenticated attacker publishes a crafted Maven artifact whose pom.xml contains a metadata element populated with an oversized value. After the deploy succeeds, any user or automation that lists components in that repository receives a failure response. See the Sonatype Support Article for vendor-published detail on the failure condition and repair procedure.

No verified public proof-of-concept code is available. Refer to the Sonatype Nexus Release Notes for the corrected behavior.

Detection Methods for CVE-2026-77121

Indicators of Compromise

Recent Maven deploy events immediately followed by repeated failures on component list or browse API calls against the same repository.
POM files stored in the blob store containing metadata fields with abnormally large character counts.
Administrator reports that a specific hosted Maven repository can no longer render its component tree in the UI.

Detection Strategies

Audit Nexus Repository access logs for deploy actions correlated with subsequent HTTP 5xx responses on /service/rest/v1/components for the same repository.
Scan hosted Maven blob stores for pom.xml files that exceed a normal size baseline for the environment.
Alert on repeated failures of scheduled Nexus tasks such as repair or rebuild operations that touch a single repository.

Monitoring Recommendations

Track deploy activity per user account and flag accounts publishing anomalously large POM payloads.
Monitor Nexus application logs for parser exceptions raised when enumerating components.
Forward Nexus audit and application logs to a centralized analytics platform to correlate publish events with browse failures.

How to Mitigate CVE-2026-77121

Immediate Actions Required

Upgrade Sonatype Nexus Repository to version 3.95.0 or later per the Sonatype Nexus Release Notes.
Review and reduce the set of accounts holding deploy privileges on hosted Maven repositories.
For any repository already exhibiting listing failures, follow the vendor repair procedure documented in the Sonatype Support Article.

Patch Information

Sonatype addressed the issue in Sonatype Nexus Repository 3.95.0. The release enforces bounds on POM metadata fields during deploy, preventing persistence of oversized values. Administrators running earlier 3.x builds should plan an upgrade to 3.95.0 or later.

Workarounds

Restrict deploy permissions on hosted Maven repositories to trusted service accounts and revoke deploy roles from general developer accounts.
Place an upload-size or content-inspection proxy in front of Nexus to reject Maven publish requests carrying oversized POM payloads.
Take regular backups of the Nexus blob store and database so that a corrupted repository can be restored without extended downtime.

bash

# Example: restrict Maven deploy role assignment via Nexus REST API
curl -u admin:$NEXUS_ADMIN_PASS \
  -X PUT "$NEXUS_URL/service/rest/v1/security/roles/nx-maven-deploy" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "nx-maven-deploy",
    "name": "maven-deploy-restricted",
    "privileges": ["nx-repository-view-maven2-*-add"],
    "roles": []
  }'