CVE-2026-77121: 
Sonatype Nexus 3 vulnerability analysis and mitigation

CVE-2026-77121 is a Denial of Service vulnerability in Sonatype Nexus Repository 3 that allows an authenticated user with artifact deployment permissions to permanently disable listing and browsing of a targeted Maven hosted repository. By uploading a POM file containing an oversized metadata field, the attacker causes the repository's component listing to fail until an administrator manually repairs the underlying data. The vulnerability affects Nexus Repository 3 versions 3.26.0 through 3.94.x (fixed in 3.95.0), and was publicly disclosed on September 2, 2026. It carries a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) — the application fails to enforce size restrictions on metadata fields within uploaded POM files, allowing arbitrarily large values to be persisted in the repository's data store (GitHub Advisory). An attacker exploits this by crafting a POM file with an oversized metadata field and deploying it to a hosted Maven repository via the standard artifact upload mechanism over the network. The precondition is that the attacker must possess a valid user account with deploy permissions on the targeted hosted Maven repository; no additional privileges or user interaction are required. Once the malicious POM is ingested, subsequent attempts to list or browse the repository's components fail permanently, as the corrupted metadata cannot be processed correctly.

Successful exploitation results in a persistent availability impact limited to the targeted Maven hosted repository — all users are unable to list or browse its components until an administrator intervenes to repair the underlying data. There is no confidentiality or integrity impact, and other repositories and overall Nexus Repository server health remain unaffected. The disruption can significantly impede development and build pipelines that depend on the affected repository, potentially causing supply chain delays (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.235%, indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable per NVD SSVC assessment, as it requires a low-privilege authenticated account with specific deploy permissions on a hosted Maven repository.

1. Obtain deploy credentials: Acquire a valid Nexus Repository user account with deploy permissions on a hosted Maven repository — this could be through legitimate access, credential theft, or a compromised CI/CD service account.
2. Craft a malicious POM file: Create a Maven POM file (pom.xml) that contains an oversized value in one or more metadata fields (e.g., an extremely long <description>, <name>, or custom property), exceeding the application's expected limits.
3. Deploy the artifact: Use standard Maven deployment tooling (e.g., mvn deploy, curl with the Nexus REST API, or the Nexus UI upload feature) to publish the crafted POM file to the targeted hosted Maven repository.
4. Trigger persistent failure: Once the malicious POM is accepted and stored, any subsequent attempt by any user to list or browse the repository's components will permanently fail, effectively rendering the repository inaccessible for normal operations.
5. Await administrative intervention: The repository remains in a broken state until an administrator manually identifies and repairs the corrupted metadata in the underlying data store (GitHub Advisory).

• Logs: Nexus Repository application logs showing repeated errors or exceptions when listing or browsing components in a specific hosted Maven repository; error messages referencing metadata parsing failures or database read errors for a particular repository.
• Logs: Audit logs recording an artifact deployment event (POM upload) to the affected repository shortly before the browsing failures began — review for unusual deployer accounts or unexpected artifact coordinates.
• Network: HTTP requests to the Nexus Repository REST API or UI endpoints for component listing (e.g., /service/rest/v1/components?repository=<repo>) returning persistent error responses (5xx) for a specific repository.
• File System / Database: Presence of a POM file with an abnormally large metadata field in the blob store associated with the affected repository.

Upgrade Sonatype Nexus Repository 3 to version 3.95.0 or later, which addresses this vulnerability (Sonatype Release Notes). As a workaround prior to patching, restrict artifact deployment permissions to only trusted, known users and service accounts to reduce the attack surface. Administrators should also monitor repository operations for anomalous listing failures and establish procedures to detect and repair corrupted metadata promptly. Implementing input validation or size limits on POM metadata fields at the repository or reverse-proxy layer can provide additional defense-in-depth.