Vulnerability Reportsonatype/nexus3:3.93.3-alpine

sonatype/nexus3:3.93.3sonatype/nexus3:3.93.3-alpine

digestsha256:5a9d4324364d16383b8285e3978e9f7216314a5bc7f924e83f83e6dcba28fe8b

Executive Summary

Last scanned: Nov 1, 2026

Threat ScoreCAUTION• CVE-2026-89407 in com.fasterxml.jackson.core:jackson-core (2.22.0) is reachable from the network in normal operation. Crafted long numeric strings in JSON requests could tie up Nexus request threads and stall the service.• CVE-2026-68497 in com.fasterxml.jackson.core:jackson-databind (2.22.0) is also reachable over the network and can tie up worker threads for a long time from a single large JSON request. Its impact is denial of service only.• CVE-2026-75595 in io.netty:netty-handler and CVE-2026-49268 in org.apache.shiro:shiro-core could bypass authentication, but each needs a non-default setup: a Netty TLS server with per-hostname client certificate rules, or an LDAP realm, respectively.• CVE-2026-10050 in org.eclipse.jetty.ee8:jetty-ee8-security could allow an authentication bypass, but only if Digest authentication is enabled and used for a login realm.• The scan found 55 exposed findings in total, 8 with severity 7.0 or higher and 21 at 6.0 or higher. None are listed as known to be actively exploited, and no findings matter only after the container is compromised.• The publisher reputation is TRUSTED, and the image is pinned by digest.

62/100CAUTION

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker who sends crafted JSON to the Nexus REST endpoints could exhaust worker threads or memory, stalling or crashing the repository service that teams depend on for builds. The most serious flaw is CVE-2026-89407 in jackson-core, which is reachable over the network in normal operation, while the authentication-bypass issues in CVE-2026-75595 and CVE-2026-49268 only apply when specific TLS client certificate rules or an LDAP realm are configured. Confirm which of those features your deployment uses before relying on this assessment, and treat the Jackson denial-of-service exposure as the priority to address.

Hardening plan for this image · 4 steps. The first cuts risk from 62 to 0.

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

55 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-89407	HIGH7.5	com.fasterxml.jackson.core:jackson-core 2.22.0 fixed in 2.18.11, 2.21.7, 2.22.3	0.6% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-68497	HIGH7.5	com.fasterxml.jackson.core:jackson-databind 2.22.0 fixed in 2.18.10, 2.21.6, 2.22.2	0.6% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-89407	HIGH7.5	tools.jackson.core:jackson-core 3.2.0 fixed in 3.1.7, 3.2.2	0.6% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-68497	HIGH7.5	tools.jackson.core:jackson-databind 3.2.0 fixed in 3.2.2, 3.1.6	0.6% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-75595	HIGH7.28	io.netty:netty-handler 4.2.15.Final fixed in 4.2.17.Final, 4.1.137.Final	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-49268	HIGH7.28	org.apache.shiro:shiro-core 1.13.0 fixed in 2.2.1, 3.0.0-alpha-2	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-10050	HIGH7.28	org.eclipse.jetty.ee8:jetty-ee8-security 12.0.33 fixed in 12.0.36, 12.1.10	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-84939	HIGH7.28	org.freemarker:freemarker 2.3.32 fixed in 2.3.35	0.9% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-89425	MEDIUM6	com.fasterxml.jackson.core:jackson-core 2.22.0 fixed in 2.21.7, 2.22.3, 2.18.11	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-91776	MEDIUM6	com.fasterxml.jackson.core:jackson-databind 2.22.0 fixed in 2.18.11, 2.21.7, 2.22.3	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-91777	MEDIUM6	com.fasterxml.jackson.core:jackson-databind 2.22.0 fixed in 2.21.7, 2.18.11, 2.22.3	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-59901	MEDIUM6	io.netty:netty-codec-compression 4.2.15.Final fixed in 4.2.16.Final	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-55831	MEDIUM6	io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final	0.7% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-59898	MEDIUM6	io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-59899	MEDIUM6	io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-56819	MEDIUM6	io.netty:netty-codec-http2 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final	0.7% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-56816	MEDIUM6	io.netty:netty-codec-http3 4.2.15.Final fixed in 4.2.16.Final	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-75140	MEDIUM6	org.jsoup:jsoup 1.15.3 fixed in 1.23.2	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-89425	MEDIUM6	tools.jackson.core:jackson-core 3.2.0 fixed in 3.1.7, 3.2.3	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-91776	MEDIUM6	tools.jackson.core:jackson-databind 3.2.0 fixed in 3.1.7, 3.2.3	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-91777	MEDIUM6	tools.jackson.core:jackson-databind 3.2.0 fixed in 3.1.7, 3.2.3	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-83557	MEDIUM5.6	com.fasterxml.jackson.core:jackson-databind 2.22.0 fixed in 2.18.10, 2.21.6, 2.22.2	0.7% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-83557	MEDIUM5.6	tools.jackson.core:jackson-databind 3.2.0 fixed in 3.1.6, 3.2.2	0.7% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-8763	MEDIUM5.46	org.bouncycastle:bc-fips 2.1.2 fixed in 1.0.2.7, 2.0.2, 2.1.3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-8763	MEDIUM5.46	org.bouncycastle:bcprov-jdk18on 1.84 fixed in 1.85	0.4% Theoretical Threat	Directly Exposed
CVE-2026-19032	MEDIUM5.3	com.fasterxml.jackson.core:jackson-databind 2.22.0 fixed in 2.18.10, 2.21.6, 2.22.2	0.6% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-54515	MEDIUM5.3	com.fasterxml.jackson.core:jackson-databind 2.22.0 fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1	0.4% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-77310	MEDIUM5.3	com.fasterxml.jackson.core:jackson-databind 2.22.0 fixed in 2.18.9, 2.21.5, 2.22.1	0.3% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-23903	MEDIUM5.3	org.apache.shiro:shiro-spring 1.13.0 fixed in 2.1.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-8384	MEDIUM5.3	org.eclipse.jetty:jetty-util 12.0.33 fixed in 12.0.35, 12.1.9	0.3% Theoretical Threat	Directly Exposed
CVE-2026-19032	MEDIUM5.3	tools.jackson.core:jackson-databind 3.2.0 fixed in 3.1.6, 3.2.2	0.6% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-77310	MEDIUM5.3	tools.jackson.core:jackson-databind 3.2.0 fixed in 3.1.5, 3.2.1	0.3% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-8798	MEDIUM5.22	org.bouncycastle:bc-fips 2.1.2 fixed in 2.1.3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-59889	MEDIUM5.2	com.fasterxml.jackson.core:jackson-databind 2.22.0 fixed in 2.21.5, 2.18.9, 2.22.1	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-56746	MEDIUM5.2	io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-59921	MEDIUM5.2	io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-43827	MEDIUM5.2	org.apache.shiro:shiro-core 1.13.0 fixed in 2.2.0, 3.0.0-alpha-2	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-43828	MEDIUM5.2	org.apache.shiro:shiro-web 1.13.0 fixed in 2.2.0, 3.0.0-alpha-2	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-59889	MEDIUM5.2	tools.jackson.core:jackson-databind 3.2.0 fixed in 3.1.5, 3.2.1	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-73508	MEDIUM4.5	io.netty:netty-codec-dns 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final	0.6% Theoretical Threat	Directly Exposed
CVE-2026-55833	MEDIUM4.5	io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final	0.7% Theoretical Threat	Directly Exposed
CVE-2026-56745	MEDIUM4.5	io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final	0.6% Theoretical Threat	Directly Exposed
CVE-2026-59903	MEDIUM4.5	io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.17.Final, 4.1.137.Final	0.3% Theoretical Threat	Directly Exposed
CVE-2026-75596	MEDIUM4.5	io.netty:netty-handler 4.2.15.Final fixed in 4.2.17.Final, 4.1.137.Final	0.4% Theoretical Threat	Directly Exposed
CVE-2026-13505	MEDIUM4.5	org.bouncycastle:bc-fips 2.1.2 fixed in 1.0.2.7, 2.0.2, 2.1.3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-13506	MEDIUM4.5	org.bouncycastle:bc-fips 2.1.2 fixed in 1.0.2.7, 2.0.2, 2.1.3	0.5% Theoretical Threat	Directly Exposed
CVE-2026-13506	MEDIUM4.5	org.bouncycastle:bcprov-jdk18on 1.84 fixed in 1.85	0.5% Theoretical Threat	Directly Exposed
CVE-2026-59900	MEDIUM4.24	io.netty:netty-codec-http2 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-71497	LOW3.76	org.jsoup:jsoup 1.15.3 fixed in 1.23.1	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-49844	LOW3.54	org.apache.logging.log4j:log4j-api 2.19.0 fixed in 2.25.5, 2.26.1	0.6% Theoretical Threat	Directly Exposed
CVE-2026-54291	LOW3.54	org.postgresql:postgresql 42.7.11 fixed in 42.7.12	0.2% Theoretical Threat	Directly Exposed
CVE-2026-113730	LOW3.36	ognl:ognl 3.4.4 fixed in 3.4.13	0.4% Theoretical Threat	Directly Exposed
CVE-2026-10532	LOW2.9	ch.qos.logback:logback-core 1.5.32 fixed in 1.5.34	0.4% Theoretical Threat	Directly Exposed
CVE-2026-23901	LOW2	org.apache.shiro:shiro-core 1.13.0 fixed in 2.1.0	0.2% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-9828	LOW1.2	ch.qos.logback:logback-core 1.5.32 fixed in 1.5.33	0.4% Theoretical Threat	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.