Vulnerability Reportsonatype/nexus3:3.91.2

sonatype/nexus3:3.91.2sonatype/nexus3:3.91.2-alpine
digestsha256:4f3e19cccdd7d152e77f8aa7be8f885bf57186b61f51c1550f92c9bc7a6dae67

Executive Summary

Last scanned:

Threat Score
64/100CAUTION
Reputation
TRUSTED

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker who can reach the Nexus web port could send crafted JSON requests that exhaust CPU and worker threads, stalling the repository service for everyone who depends on it (CVE-2026-89407). Several Netty findings, such as CVE-2026-45674, only matter if DNS resolution, HTTP proxying, or TLS routing is configured in ways not stated for this image, so confirm that before deciding. Upgrading the jackson-core and jackson-databind packages should be the first remediation step before production use.

Hardening plan for this image · 4 steps. The first cuts risk from 64 to 0.

Included in Pro

Scanning procedure

  1. Vulnerability scan
    Full CVE sweep across OS packages and app dependencies
  2. Exploitability check
    CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
  3. Reachability analysis
    Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
  4. Runtime verification
    Live-container probes: exposed endpoints, feature flags, real defaults
  5. Supply chain analysis
    Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
  6. Hardening recommendations
    A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

104 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-45674HIGH8
io.netty:netty-resolver-dns
4.2.10.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-47691HIGH8
io.netty:netty-resolver-dns
4.2.10.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-42581HIGH7.84
io.netty:netty-codec-http
4.2.10.Final
fixed in 4.2.13.Final, 4.1.133.Final
0.6%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-89407HIGH7.5
com.fasterxml.jackson.core:jackson-core
2.21.1
fixed in 2.18.11, 2.21.7, 2.22.3
0.6%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-68497HIGH7.5
com.fasterxml.jackson.core:jackson-databind
2.21.1
fixed in 2.18.10, 2.21.6, 2.22.2
0.6%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-42579HIGH7.28
io.netty:netty-codec-dns
4.2.10.Final
fixed in 4.2.13.Final, 4.1.133.Final
1.0%
Low-Moderate Risk
Directly ExposedContext importance: MEDIUM
CVE-2026-42584HIGH7.28
io.netty:netty-codec-http
4.2.10.Final
fixed in 4.2.13.Final, 4.1.133.Final
0.8%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-75595HIGH7.28
io.netty:netty-handler
4.2.10.Final
fixed in 4.2.17.Final, 4.1.137.Final
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-49268HIGH7.28
org.apache.shiro:shiro-core
1.13.0
fixed in 2.2.1, 3.0.0-alpha-2
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-10050HIGH7.28
org.eclipse.jetty.ee8:jetty-ee8-security
12.0.33
fixed in 12.0.36, 12.1.10
0.6%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-54518MEDIUM6.5
com.fasterxml.jackson.core:jackson-databind
2.21.1
fixed in 2.21.4
0.4%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-59888MEDIUM6.5
com.fasterxml.jackson.core:jackson-databind
2.21.1
fixed in 2.18.8, 2.21.4
0.4%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-59889MEDIUM6.5
com.fasterxml.jackson.core:jackson-databind
2.21.1
fixed in 2.21.5, 2.18.9, 2.22.1
0.3%
Theoretical Threat
Directly ExposedContext importance: HIGH
GHSA-mhm7-754m-9p8wMEDIUM6.5
com.fasterxml.jackson.core:jackson-databind
2.21.1
fixed in 2.18.9, 2.21.5
—
Directly ExposedContext importance: HIGH
CVE-2026-54512MEDIUM6.48
com.fasterxml.jackson.core:jackson-databind
2.21.1
fixed in 2.18.8, 3.1.4, 2.21.4
0.9%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-54513MEDIUM6.48
com.fasterxml.jackson.core:jackson-databind
2.21.1
fixed in 2.18.8, 2.21.4, 3.1.4
1.2%
Low-Moderate Risk
Directly ExposedContext importance: MEDIUM
CVE-2026-89425MEDIUM6
com.fasterxml.jackson.core:jackson-core
2.21.1
fixed in 2.21.7, 2.22.3, 2.18.11
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2024-47554MEDIUM6
commons-io:commons-io
2.8.0
fixed in 2.14.0
1.3%
Low-Moderate Risk
Directly ExposedContext importance: MEDIUM
CVE-2026-42583MEDIUM6
io.netty:netty-codec-compression
4.2.10.Final
fixed in 4.2.13.Final
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-59901MEDIUM6
io.netty:netty-codec-compression
4.2.10.Final
fixed in 4.2.16.Final
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-73508MEDIUM6
io.netty:netty-codec-dns
4.2.10.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.6%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-42587MEDIUM6
io.netty:netty-codec-http
4.2.10.Final
fixed in 4.2.13.Final, 4.1.133.Final
1.0%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-55831MEDIUM6
io.netty:netty-codec-http
4.2.10.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.7%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-55833MEDIUM6
io.netty:netty-codec-http
4.2.10.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.7%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-56745MEDIUM6
io.netty:netty-codec-http
4.2.10.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.6%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-42585MEDIUM6
io.netty:netty-codec-http
4.2.10.Final
fixed in 4.2.13.Final, 4.1.133.Final
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-59898MEDIUM6
io.netty:netty-codec-http
4.2.10.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-59899MEDIUM6
io.netty:netty-codec-http
4.2.10.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.6%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-59903MEDIUM6
io.netty:netty-codec-http
4.2.10.Final
fixed in 4.2.17.Final, 4.1.137.Final
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-33871MEDIUM6
io.netty:netty-codec-http2
4.2.10.Final
fixed in 4.1.132.Final, 4.2.11.Final
1.1%
Low-Moderate Risk
Directly ExposedContext importance: MEDIUM
CVE-2026-42587MEDIUM6
io.netty:netty-codec-http2
4.2.10.Final
fixed in 4.2.13.Final, 4.1.133.Final
1.0%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-56819MEDIUM6
io.netty:netty-codec-http2
4.2.10.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.7%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-48043MEDIUM6
io.netty:netty-codec-http2
4.2.10.Final
fixed in 4.1.135.Final, 4.2.15.Final
0.8%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-45416MEDIUM6
io.netty:netty-handler
4.2.10.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.9%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-50010MEDIUM6
io.netty:netty-handler
4.2.10.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-75596MEDIUM6
io.netty:netty-handler
4.2.10.Final
fixed in 4.2.17.Final, 4.1.137.Final
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-42577MEDIUM6
io.netty:netty-transport-classes-epoll
4.2.10.Final
fixed in 4.2.13.Final
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-75140MEDIUM6
org.jsoup:jsoup
1.15.3
fixed in 1.23.2
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-49844MEDIUM5.9
org.apache.logging.log4j:log4j-api
2.19.0
fixed in 2.25.5, 2.26.1
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-83557MEDIUM5.6
com.fasterxml.jackson.core:jackson-databind
2.21.1
fixed in 2.18.10, 2.21.6, 2.22.2
0.7%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-113730MEDIUM5.6
ognl:ognl
3.4.2
fixed in 3.4.13
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-84939MEDIUM5.46
org.freemarker:freemarker
2.3.32
fixed in 2.3.35
0.9%
Theoretical Threat
Directly Exposed
CVE-2026-45673MEDIUM5.44
io.netty:netty-resolver-dns
4.2.10.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-19032MEDIUM5.3
com.fasterxml.jackson.core:jackson-databind
2.21.1
fixed in 2.18.10, 2.21.6, 2.22.2
0.6%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-54514MEDIUM5.3
com.fasterxml.jackson.core:jackson-databind
2.21.1
fixed in 2.18.8, 2.21.4, 3.1.4
0.4%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-54515MEDIUM5.3
com.fasterxml.jackson.core:jackson-databind
2.21.1
fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1
0.4%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-54516MEDIUM5.3
com.fasterxml.jackson.core:jackson-databind
2.21.1
fixed in 2.21.4, 3.1.4
0.4%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-54517MEDIUM5.3
com.fasterxml.jackson.core:jackson-databind
2.21.1
fixed in 2.21.4, 3.1.4
0.4%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-77310MEDIUM5.3
com.fasterxml.jackson.core:jackson-databind
2.21.1
fixed in 2.18.9, 2.21.5, 2.22.1
0.3%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-45292MEDIUM5.3
io.opentelemetry:opentelemetry-api
1.47.0
fixed in 1.62.0
1.1%
Low-Moderate Risk
Directly Exposed
CVE-2026-23903MEDIUM5.3
org.apache.shiro:shiro-spring
1.13.0
fixed in 2.1.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-8384MEDIUM5.3
org.eclipse.jetty:jetty-util
12.0.33
fixed in 12.0.35, 12.1.9
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-41001MEDIUM5.3
org.springframework.boot:spring-boot-autoconfigure
3.5.12
fixed in 4.0.7, 3.5.15
<0.1%
Theoretical Threat
Directly Exposed
CVE-2025-67030MEDIUM5.28
org.codehaus.plexus:plexus-utils
3.5.1
fixed in 4.0.3, 3.6.1
0.7%
Theoretical Threat
Directly Exposed
CVE-2026-42580MEDIUM5.2
io.netty:netty-codec-http
4.2.10.Final
fixed in 4.2.13.Final, 4.1.133.Final
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-56746MEDIUM5.2
io.netty:netty-codec-http
4.2.10.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-59921MEDIUM5.2
io.netty:netty-codec-http
4.2.10.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-43827MEDIUM5.2
org.apache.shiro:shiro-core
1.13.0
fixed in 2.2.0, 3.0.0-alpha-2
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-43828MEDIUM5.2
org.apache.shiro:shiro-web
1.13.0
fixed in 2.2.0, 3.0.0-alpha-2
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-1225MEDIUM5
ch.qos.logback:logback-core
1.5.19
fixed in 1.5.25
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-44249MEDIUM4.86
io.netty:netty-handler
4.2.10.Final
fixed in 4.2.15.Final, 4.1.135.Final
1.0%
Theoretical Threat
Directly Exposed
CVE-2026-47838MEDIUM4.86
org.springframework.security:spring-security-web
6.5.9
fixed in 6.5.11
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-22751MEDIUM4.8
org.springframework.security:spring-security-core
6.5.9
fixed in 6.5.10, 7.0.5
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-68494MEDIUM4.5
com.fasterxml.jackson.core:jackson-core
2.21.1
fixed in 2.18.8, 2.21.4
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-91776MEDIUM4.5
com.fasterxml.jackson.core:jackson-databind
2.21.1
fixed in 2.18.11, 2.21.7, 2.22.3
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-91777MEDIUM4.5
com.fasterxml.jackson.core:jackson-databind
2.21.1
fixed in 2.21.7, 2.18.11, 2.22.3
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-42578MEDIUM4.5
io.netty:netty-handler-proxy
4.2.10.Final
fixed in 4.1.133.Final, 4.2.13.Final
1.1%
Low-Moderate Risk
Directly Exposed
CVE-2026-3505MEDIUM4.5
org.bouncycastle:bcpg-jdk15to18
1.81
fixed in 1.84
0.8%
Theoretical Threat
Directly Exposed
CVE-2026-5588MEDIUM4.5
org.bouncycastle:bcpkix-jdk15to18
1.81
fixed in 1.84
0.8%
Theoretical Threat
Directly Exposed
CVE-2026-5588MEDIUM4.5
org.bouncycastle:bcpkix-jdk18on
1.81
fixed in 1.84
0.8%
Theoretical Threat
Directly Exposed
CVE-2026-42198MEDIUM4.5
org.postgresql:postgresql
42.7.2
fixed in 42.7.11
3.3%
Low-Moderate Risk
Directly Exposed
CVE-2026-40988MEDIUM4.5
org.springframework.security:spring-security-saml2-service-provider
6.5.9
fixed in 7.0.6, 6.5.11
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-41848MEDIUM4.5
org.springframework:spring-core
6.2.17
fixed in 7.0.8, 6.2.19
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-41850MEDIUM4.5
org.springframework:spring-expression
6.2.17
fixed in 7.0.8, 6.2.19
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-41851MEDIUM4.5
org.springframework:spring-expression
6.2.17
fixed in 7.0.8, 6.2.19
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-41417MEDIUM4.24
io.netty:netty-codec-http
4.2.10.Final
fixed in 4.1.133.Final, 4.2.13.Final
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-50020MEDIUM4.24
io.netty:netty-codec-http
4.2.10.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.2%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-47244MEDIUM4.24
io.netty:netty-codec-http2
4.2.10.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-50560MEDIUM4.24
io.netty:netty-codec-http2
4.2.10.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-59900MEDIUM4.24
io.netty:netty-codec-http2
4.2.10.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-40973MEDIUM4.2
org.springframework.boot:spring-boot
3.5.12
fixed in 4.0.6, 3.5.14
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-45536MEDIUM4
io.netty:netty-transport-native-epoll
4.2.10.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-45536MEDIUM4
io.netty:netty-transport-native-kqueue
4.2.10.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-41854LOW3.9
org.springframework:spring-web
6.2.17
fixed in 7.0.8, 6.2.19
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-71497LOW3.76
org.jsoup:jsoup
1.15.3
fixed in 1.23.1
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-22746LOW3.7
org.springframework.security:spring-security-core
6.5.9
fixed in 6.5.10, 7.0.5
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-41706LOW3.66
org.springframework.security:spring-security-web
6.5.9
fixed in 7.0.6, 6.5.11
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-8763LOW3.28
org.bouncycastle:bc-fips
2.1.2
fixed in 1.0.2.7, 2.0.2, 2.1.3
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-8763LOW3.28
org.bouncycastle:bcprov-jdk15to18
1.81
fixed in 1.85
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-8763LOW3.28
org.bouncycastle:bcprov-jdk18on
1.81.1
fixed in 1.85
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-41003LOW3.24
org.springframework.security:spring-security-saml2-service-provider
6.5.9
fixed in 7.0.6, 6.5.11
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-41694LOW3.18
org.springframework.security:spring-security-saml2-service-provider
6.5.9
fixed in 7.0.6, 6.5.11
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-41852LOW3.18
org.springframework:spring-expression
6.2.17
fixed in 7.0.8, 6.2.19
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-8798LOW3.13
org.bouncycastle:bc-fips
2.1.2
fixed in 2.1.3
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-10532LOW2.9
ch.qos.logback:logback-core
1.5.19
fixed in 1.5.34
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-13505LOW2.7
org.bouncycastle:bc-fips
2.1.2
fixed in 1.0.2.7, 2.0.2, 2.1.3
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-13506LOW2.7
org.bouncycastle:bc-fips
2.1.2
fixed in 1.0.2.7, 2.0.2, 2.1.3
0.5%
Theoretical Threat
Post-Exploit
CVE-2025-14813LOW2.7
org.bouncycastle:bcprov-jdk15to18
1.81
fixed in 1.84
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-13506LOW2.7
org.bouncycastle:bcprov-jdk15to18
1.81
fixed in 1.85
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-13506LOW2.7
org.bouncycastle:bcprov-jdk18on
1.81.1
fixed in 1.85
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-0636LOW2.34
org.bouncycastle:bcprov-jdk15to18
1.81
fixed in 1.84
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-0636LOW2.34
org.bouncycastle:bcprov-jdk18on
1.81.1
fixed in 1.84
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-23901LOW2
org.apache.shiro:shiro-core
1.13.0
fixed in 2.1.0
0.2%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-9828LOW1.2
ch.qos.logback:logback-core
1.5.19
fixed in 1.5.33
0.4%
Theoretical Threat
Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.