Vulnerability Reportsonatype/nexus3:3.96.5-alpine

sonatype/nexus3:3.96.5sonatype/nexus3:3.96.5-alpine

digestsha256:d70482a3d5d44c8733fb244742fef5ca8ac967da56ccb97398f807bb8d3e585e

Executive Summary

Last scanned: Nov 1, 2026

Threat ScoreNEEDS ATTENTION• CVE-2026-75140 in the org.jsoup:jsoup library (version 1.23.1) can be triggered by a deeply nested XML document and crash the Nexus service by exhausting heap memory.• The scan found two exposed findings in total, and one of them is rated 6.0 in severity; no finding is known to be actively exploited.• The jsoup flaw only matters if Nexus parses attacker-supplied XML through jsoup, which needs a non-default setup, and the container context does not confirm that this path is used in normal operation.• No findings matter only after the container is already compromised, so the post-compromise exposure is empty.• The publisher reputation is TRUSTED, and the image is pinned by digest.

25/100NEEDS ATTENTION

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The main concern is CVE-2026-75140 in the jsoup library, where a crafted, deeply nested XML request could exhaust memory and crash the Nexus service, causing a denial of service rather than data theft or code execution. This is a moderate issue whose reachability in this deployment is uncertain, so it does not push the verdict higher. Upgrading the jsoup library to a fixed release is the practical step to take.

Hardening plan for this image · 4 steps

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

2 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-75140	MEDIUM6	org.jsoup:jsoup 1.23.1 fixed in 1.23.2	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-113730	LOW3.36	ognl:ognl 3.4.4 fixed in 3.4.13	0.4% Theoretical Threat	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.