CVE-2026-77121

MediumCVSS 6.5/10Last modified Oct 7, 2026

Description

A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only the targeted repository is affected; other repositories and overall server health remain unaffected.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-771224.3An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Rep CVE-2026-771236.5Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabi CVE-2026-771247.2In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether s CVE-2026-771257.1A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly e CVE-2026-771276.0The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authen CVE-2026-771286.3The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-o CVE-2026-771297.7The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user w CVE-2026-77136.3A vulnerability was detected in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this vulnerability is the function generate_au CVE-2026-771305.3The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key t CVE-2026-771315.3When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitat CVE-2026-771325.3It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowe CVE-2026-771336.0The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses