Log in Start free

Vulnerability · Published Apr 23, 2021 · Assigned by apache

CVE-2021-26291block repositories using http by default

Critical 9.1

In plain English

A critical-severity security flaw in Apache Maven from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.7% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.1Critical
Exploit odds (30 days)8.7%top 4.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12maven3.8.6-1DEBIAN-CVE-2021-26291
Debian:13maven3.8.6-1DEBIAN-CVE-2021-26291
Debian:14maven3.8.6-1DEBIAN-CVE-2021-26291
Mavenorg.apache.maven:maven-compat3.8.1GHSA-2f88-5hg8-9x2x
Mavenorg.apache.maven:maven-core3.8.1GHSA-2f88-5hg8-9x2x

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Maven Apache Maven – through 3.8.1

References