The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade maven | Jul 30, 2024 | Apr 23, 2021 |
| Freebsd | — | Upgrade maven | Nov 4, 2022 | Apr 19, 2021 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 34298772 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 34236279 for version 12.2.1.4.0. | Jul 25, 2022 | Apr 23, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 23, 2021 |
| Suse | — | Upgrade maven-common-artifact-filters-javadocUpgrade maven-plugin-annotationsUpgrade maven-doxia-module-fmlUpgrade maven-failsafe-pluginUpgrade maven-plugin-testingUpgrade maven-surefireUpgrade maven-install-plugin-javadocUpgrade maven-plugin-plugin-bootstrapUpgrade maven-doxia-module-twikiUpgrade maven-surefire-provider-junit5Upgrade maven-plugin-tools-javadocUpgrade maven-compiler-pluginUpgrade exec-maven-pluginUpgrade maven-shared-utilsUpgrade maven-file-management-javadocUpgrade maven-common-artifact-filtersUpgrade javacc-maven-plugin-javadocUpgrade maven-jar-pluginUpgrade maven-plugin-testing-harnessUpgrade maven-filtering-javadocUpgrade maven-enforcer-pluginUpgrade maven-enforcerUpgrade modello-maven-pluginUpgrade spec-version-maven-pluginUpgrade maven-wagon-provider-apiUpgrade maven-projectUpgrade maven-reporting-apiUpgrade maven-dependency-analyzer-javadocUpgrade maven-doxia-module-docbook-simpleUpgrade string-template-maven-plugin-javadocUpgrade maven-resolver-named-locksUpgrade maven-javadoc-plugin-javadocUpgrade maven-doxia-javadocUpgrade maven-plugin-plugin-javadocUpgrade maven-resolver-transport-httpUpgrade maven-modelUpgrade maven-assembly-pluginUpgrade maven-settingsUpgrade maven-wagon-ssh-externalUpgrade maven-resolver-apiUpgrade maven-plugin-testing-javadocUpgrade maven-shared-ioUpgrade maven-plugin-build-helper-javadocUpgrade maven-surefire-pluginUpgrade maven-dependency-plugin-javadocUpgrade maven-javadoc-pluginUpgrade maven-archiver-javadocUpgrade maven-doxia-sitetools-javadocUpgrade maven-assembly-plugin-javadocUpgrade maven-plugin-testing-toolsUpgrade maven-resources-pluginUpgrade maven-javadocUpgrade maven-test-toolsUpgrade maven-resolver-utilUpgrade maven-source-pluginUpgrade javacc-maven-pluginUpgrade maven-surefire-report-parserUpgrade maven-profileUpgrade maven-surefire-provider-junit5-javadocUpgrade maven-antrun-pluginUpgrade maven-plugin-tools-beanshellUpgrade paranamer-maven-pluginUpgrade maven-enforcer-apiUpgrade xml-maven-pluginUpgrade bnd-maven-plugin-javadocUpgrade os-maven-plugin-javadocUpgrade maven-doxia-sink-apiUpgrade maven-resolver-transport-classpathUpgrade spec-version-maven-plugin-javadocUpgrade gmavenplus-plugin-javadocUpgrade maven-surefire-report-plugin-bootstrapUpgrade maven-dependency-pluginUpgrade maven-archiverUpgrade maven-resolver-javadocUpgrade maven-shared-incremental-javadocUpgrade maven-artifact-managerUpgrade maven-clean-plugin-javadocUpgrade maven-plugin-tools-modelUpgrade maven-doxia-module-rtfUpgrade maven-antrun-plugin-javadocUpgrade maven-shared-incrementalUpgrade maven-plugin-build-helperUpgrade maven-surefire-javadocUpgrade maven-file-managementUpgrade maven-verifier-javadocUpgrade maven-surefire-provider-testngUpgrade maven-wagon-fileUpgrade maven-reporting-api-javadocUpgrade maven-doxia-module-xhtmlUpgrade maven-localUpgrade maven-resources-plugin-javadocUpgrade maven-doxia-module-foUpgrade maven-dependency-tree-javadocUpgrade exec-maven-plugin-javadocUpgrade maven-remote-resources-pluginUpgrade maven-artifact-resolverUpgrade maven-dependency-analyzerUpgrade bnd-maven-pluginUpgrade maven-resolver-test-utilUpgrade maven-doxia-module-xdocUpgrade maven-script-beanshellUpgrade maven-script-antUpgrade maven-plugin-bundleUpgrade maven-artifactUpgrade maven-mappingUpgrade antlr4-maven-pluginUpgrade maven-resources-plugin-bootstrapUpgrade maven-remote-resources-plugin-javadocUpgrade maven-install-pluginUpgrade maven-monitorUpgrade maven-filteringUpgrade maven-clean-pluginUpgrade maven-wagon-ssh-commonUpgrade maven-plugin-tools-annotationsUpgrade maven-wagon-httpUpgrade string-template-maven-pluginUpgrade maven-jar-plugin-bootstrapUpgrade maven-resolver-implUpgrade maven-artifact-resolver-javadocUpgrade maven-plugin-pluginUpgrade gmavenplus-pluginUpgrade maven-wagon-ftpUpgrade hawtjni-maven-pluginUpgrade maven-verifierUpgrade maven-shared-utils-javadocUpgrade maven-libUpgrade maven-invokerUpgrade maven-surefire-report-pluginUpgrade maven-wagon-sshUpgrade tesla-polyglot-maven-pluginUpgrade maven-enforcer-javadocUpgrade maven-doxia-module-xhtml5Upgrade maven-mapping-javadocUpgrade maven-plugin-registryUpgrade maven-plugin-tools-apiUpgrade maven-toolchainUpgrade maven-wagon-http-lightweightUpgrade maven-compiler-plugin-javadocUpgrade maven-plugin-tools-javaUpgrade maven-doxia-module-confluenceUpgrade maven-resolver-transport-wagonUpgrade maven-surefire-plugin-bootstrapUpgrade maven-plugin-descriptorUpgrade maven-surefire-plugins-javadocUpgrade maven-compiler-plugin-bootstrapUpgrade maven-doxia-module-latexUpgrade os-maven-pluginUpgrade maven-dependency-treeUpgrade maven-resolver-transport-fileUpgrade maven-artifact-transferUpgrade maven-resolverUpgrade maven-javadoc-plugin-bootstrapUpgrade maven-invoker-javadocUpgrade maven-enforcer-rulesUpgrade maven-wagon-http-sharedUpgrade maven-jar-plugin-javadocUpgrade maven-doxia-logging-apiUpgrade maven-surefire-provider-junitUpgrade hawtjni-maven-plugin-javadocUpgrade maven-artifact-transfer-javadocUpgrade mavenUpgrade maven-doxia-coreUpgrade maven-doxia-module-aptUpgrade maven-doxia-test-docsUpgrade maven-resolver-spiUpgrade maven-source-plugin-javadocUpgrade maven-failsafe-plugin-bootstrapUpgrade maven-plugin-tools-antUpgrade maven-plugin-tools-generatorsUpgrade modello-maven-plugin-javadocUpgrade maven-plugin-bundle-javadocUpgrade maven-doxia-sitetoolsUpgrade maven-wagon-javadocUpgrade maven2-javadocUpgrade maven-resolver-connector-basicUpgrade xml-maven-plugin-javadocUpgrade maven-shared-io-javadoc | Aug 9, 2024 | Apr 23, 2021 |
| Ubuntu | — | Upgrade mavenUpgrade libmaven3-core-java (Ubuntu Pro)Upgrade maven (Ubuntu Pro)Upgrade libmaven3-core-java | Jan 16, 2023 | Apr 23, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 19, 2025 | Apr 23, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub