CVE-2026-77121: Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields
A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only the targeted repository is affected; other repositories and overall server health remain unaffected.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user account that has permission to deploy artifacts to a hosted Maven repository can exploit it. The issue is limited to hosted Maven repositories where that level of upload access is granted.
What is the operational impact if a repository is poisoned?
Future attempts to list or browse components in the targeted repository permanently fail until an administrator repairs the underlying data. Other repositories and overall server health remain unaffected.
What should administrators do if they cannot immediately apply an update?
Restrict deploy permissions for hosted Maven repositories to trusted users and automation, since artifact deployment access is required for exploitation. Monitor uploaded POM files for oversized metadata fields where feasible.
How can an administrator recognize that exploitation may have occurred?
A potentially affected repository will fail when users attempt to list or browse its components, while other repositories continue to function normally. Recovery requires administrator repair of the underlying repository data.