Vulnerability Reportsonatype/nexus3:3.95.5-alpine

sonatype/nexus3:3.95.5sonatype/nexus3:3.95.5-alpine

digestsha256:aa19c1ae9024fbd474568acb582668b936c9b9586401838e4e04c898eb6c9f17

Executive Summary

Last scanned: Nov 1, 2026

Threat ScoreNEEDS ATTENTION• CVE-2026-75140 in the org.jsoup:jsoup 1.15.3 library is the only finding that matters here. A crafted deeply nested XML document could exhaust Java heap memory and crash the Nexus process, causing a service outage.• The flaw only applies if the application parses attacker-supplied XML with jsoup's XML builder, which is not confirmed for this image.• The scan found 4 exposed findings in total. Only 1 has a severity of 6.0 or higher, and none are listed as known to be actively exploited.• No findings were classed as reachable only after the container is already compromised.• The publisher reputation verdict is TRUSTED, with the image pinned by digest.

25/100NEEDS ATTENTION

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The main concern is CVE-2026-75140 in the jsoup library, where a malicious XML document could exhaust memory and take the Nexus service offline. This is a denial-of-service issue rather than a path to data theft or code execution, and it only matters if XML from untrusted sources reaches that parser. Confirming that the application does not parse attacker-supplied XML with jsoup's XML builder would remove this exposure.

Hardening plan for this image · 4 steps

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

4 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-75140	MEDIUM6	org.jsoup:jsoup 1.15.3 fixed in 1.23.2	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-8384	MEDIUM4.24	org.eclipse.jetty:jetty-util 12.0.33 fixed in 12.0.35, 12.1.9	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-113730	LOW3.36	ognl:ognl 3.4.4 fixed in 3.4.13	0.4% Theoretical Threat	Directly Exposed
CVE-2026-71497	LOW2.82	org.jsoup:jsoup 1.15.3 fixed in 1.23.1	0.3% Theoretical Threat	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.