Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade maven | Jul 30, 2024 | Apr 23, 2021 |
| Freebsd | — | Upgrade maven | Nov 4, 2022 | Apr 19, 2021 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 34298772 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 34236279 for version 12.2.1.4.0. | Jul 25, 2022 | Apr 23, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 23, 2021 |
| Suse | — | Upgrade maven-resolver-test-utilUpgrade maven-toolchainUpgrade maven-wagon-javadocUpgrade maven-doxia-module-latexUpgrade maven-filteringUpgrade maven-install-pluginUpgrade maven-enforcer-javadocUpgrade maven-doxia-module-xdocUpgrade maven-wagon-ftpUpgrade maven-jar-plugin-bootstrapUpgrade maven-resolver-implUpgrade string-template-maven-pluginUpgrade gmavenplus-pluginUpgrade maven-plugin-pluginUpgrade maven-doxia-module-confluenceUpgrade maven-plugin-bundleUpgrade antlr4-maven-pluginUpgrade hawtjni-maven-pluginUpgrade maven-wagon-httpUpgrade maven-source-plugin-javadocUpgrade maven-script-antUpgrade maven-remote-resources-pluginUpgrade xml-maven-plugin-javadocUpgrade maven-jar-plugin-javadocUpgrade maven-plugin-tools-apiUpgrade maven-doxia-logging-apiUpgrade maven-wagon-http-lightweightUpgrade maven-monitorUpgrade maven-clean-pluginUpgrade hawtjni-maven-plugin-javadocUpgrade maven-surefire-report-pluginUpgrade maven-surefire-provider-junitUpgrade maven-wagon-sshUpgrade maven-plugin-registryUpgrade os-maven-pluginUpgrade maven-resolver-transport-fileUpgrade tesla-polyglot-maven-pluginUpgrade maven-artifact-resolver-javadocUpgrade maven-shared-utils-javadocUpgrade maven-plugin-tools-annotationsUpgrade maven-doxia-module-xhtml5Upgrade maven-surefire-plugins-javadocUpgrade maven-plugin-tools-javaUpgrade maven-resolver-spiUpgrade maven-invokerUpgrade maven-failsafe-plugin-bootstrapUpgrade maven-mappingUpgrade maven-plugin-bundle-javadocUpgrade maven-remote-resources-plugin-javadocUpgrade maven-artifact-transfer-javadocUpgrade maven-plugin-tools-generatorsUpgrade maven-artifact-resolverUpgrade maven-doxia-coreUpgrade maven-resolver-connector-basicUpgrade bnd-maven-pluginUpgrade maven-doxia-sitetoolsUpgrade maven-plugin-descriptorUpgrade maven2-javadocUpgrade maven-plugin-tools-antUpgrade maven-shared-io-javadocUpgrade maven-dependency-analyzerUpgrade maven-resources-plugin-bootstrapUpgrade maven-verifierUpgrade maven-wagon-ssh-commonUpgrade mavenUpgrade maven-surefire-plugin-bootstrapUpgrade modello-maven-plugin-javadocUpgrade maven-libUpgrade maven-resolverUpgrade maven-resolver-transport-wagonUpgrade maven-doxia-module-aptUpgrade maven-mapping-javadocUpgrade maven-wagon-http-sharedUpgrade maven-script-beanshellUpgrade maven-artifactUpgrade maven-compiler-plugin-bootstrapUpgrade maven-javadoc-plugin-bootstrapUpgrade maven-invoker-javadocUpgrade maven-artifact-transferUpgrade maven-compiler-plugin-javadocUpgrade maven-dependency-treeUpgrade maven-enforcer-rulesUpgrade maven-doxia-test-docsUpgrade exec-maven-plugin-javadocUpgrade bnd-maven-plugin-javadocUpgrade maven-artifact-managerUpgrade maven-reporting-api-javadocUpgrade maven-plugin-testing-javadocUpgrade maven-resources-pluginUpgrade maven-surefire-report-parserUpgrade maven-javadocUpgrade maven-plugin-testing-toolsUpgrade maven-test-toolsUpgrade maven-surefire-javadocUpgrade maven-failsafe-pluginUpgrade spec-version-maven-pluginUpgrade maven-shared-utilsUpgrade maven-source-pluginUpgrade maven-shared-incremental-javadocUpgrade maven-surefireUpgrade maven-surefire-provider-junit5Upgrade maven-doxia-module-foUpgrade exec-maven-pluginUpgrade maven-plugin-plugin-bootstrapUpgrade maven-clean-plugin-javadocUpgrade maven-dependency-pluginUpgrade maven-doxia-module-xhtmlUpgrade maven-resolver-javadocUpgrade maven-resolver-utilUpgrade maven-assembly-plugin-javadocUpgrade maven-compiler-pluginUpgrade maven-enforcerUpgrade javacc-maven-plugin-javadocUpgrade maven-doxia-sink-apiUpgrade maven-enforcer-apiUpgrade gmavenplus-plugin-javadocUpgrade maven-resolver-transport-classpathUpgrade string-template-maven-plugin-javadocUpgrade spec-version-maven-plugin-javadocUpgrade maven-resolver-transport-httpUpgrade maven-doxia-javadocUpgrade maven-plugin-build-helperUpgrade maven-dependency-tree-javadocUpgrade maven-file-management-javadocUpgrade maven-plugin-testingUpgrade maven-common-artifact-filtersUpgrade maven-plugin-tools-modelUpgrade maven-doxia-sitetools-javadocUpgrade maven-verifier-javadocUpgrade maven-surefire-pluginUpgrade maven-install-plugin-javadocUpgrade maven-resources-plugin-javadocUpgrade os-maven-plugin-javadocUpgrade maven-shared-ioUpgrade maven-plugin-build-helper-javadocUpgrade maven-localUpgrade maven-file-managementUpgrade maven-dependency-plugin-javadocUpgrade maven-common-artifact-filters-javadocUpgrade maven-archiver-javadocUpgrade maven-surefire-provider-testngUpgrade maven-javadoc-pluginUpgrade maven-plugin-annotationsUpgrade maven-wagon-ssh-externalUpgrade maven-wagon-fileUpgrade maven-antrun-plugin-javadocUpgrade maven-plugin-plugin-javadocUpgrade modello-maven-pluginUpgrade maven-profileUpgrade maven-doxia-module-rtfUpgrade maven-antrun-pluginUpgrade maven-reporting-apiUpgrade maven-doxia-module-twikiUpgrade maven-settingsUpgrade maven-surefire-provider-junit5-javadocUpgrade xml-maven-pluginUpgrade maven-resolver-apiUpgrade maven-resolver-named-locksUpgrade maven-assembly-pluginUpgrade paranamer-maven-pluginUpgrade maven-plugin-testing-harnessUpgrade maven-jar-pluginUpgrade maven-wagon-provider-apiUpgrade maven-doxia-module-fmlUpgrade maven-surefire-report-plugin-bootstrapUpgrade maven-enforcer-pluginUpgrade maven-filtering-javadocUpgrade maven-dependency-analyzer-javadocUpgrade maven-modelUpgrade maven-projectUpgrade maven-doxia-module-docbook-simpleUpgrade maven-plugin-tools-javadocUpgrade maven-plugin-tools-beanshellUpgrade maven-javadoc-plugin-javadocUpgrade javacc-maven-pluginUpgrade maven-archiverUpgrade maven-shared-incremental | Aug 9, 2024 | Apr 23, 2021 |
| Ubuntu | — | Upgrade maven (Ubuntu Pro)Upgrade libmaven3-core-java (Ubuntu Pro)Upgrade libmaven3-core-javaUpgrade maven | Jan 16, 2023 | Apr 23, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 19, 2025 | Apr 23, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub