Skip to content
Fencer Vulns
critical 9.1

CVE-2021-26291 json

block repositories using http by default

published 2021-04-23 5 y ago modified 2026-09-10 1 mo ago also BIT-maven-2021-26291 , EUVD-2021-1241 , GHSA-2f88-5hg8-9x2x

cvss
9.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
8.7%
EPSS 8.7% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html

Patch / fix

  • maven org.apache.maven:maven-compat 3.8.1
  • maven org.apache.maven:maven-core 3.8.1
  • bitnami maven 3.8.1
  • apache maven 3.8.1
  • quarkus quarkus 1.13.5
  • maven Debian 14, Debian 13, Debian 12 3.8.6-1

debian advisories DEBIAN-CVE-2021-26291

  • maven Ubuntu Pro 16.04 LTS 3.3.9-3ubuntu0.1~esm1
  • maven Ubuntu Pro 18.04 LTS 3.6.0-1~18.04.1ubuntu0.1~esm1
  • maven Ubuntu Pro 20.04 LTS 3.6.3-1ubuntu0.1~esm1
  • maven Ubuntu Pro 22.04 LTS 3.6.3-5ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2021-26291

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • jenkins ocp tools 4.11 2.387.1.1683009763-3.el8
  • jenkins-2-plugins ocp tools 4.11 4.11.1683009941-1.el8
  • jenkins ocp tools 4.12 2.426.3.1706515686-3.el8
  • jenkins-2-plugins ocp tools 4.12 4.12.1706515741-1.el8
  • jenkins ocp tools 4.13 2.426.3.1706516254-3.el8
  • jenkins-2-plugins ocp tools 4.13 4.13.1706516346-1.el8

red hat advisories RHSA-2023:3198RHSA-2024:0778RHSA-2024:0776

  • clojure openSUSE Tumbleweed 1.10.3.855-1.2

opensuse advisories openSUSE-SU-2024:10687-1

  • maven Arch Linux 3.8.1-1

arch linux advisories AVG-1863

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-26291 updated cvss 7.4

maven: Block repositories using http by default

  • Red Hat build of OpenJDK 1.8 openjdk-1.8/openjdk-8-ubi8-container, redhat-openjdk-18-openjdk18-openshift redhat-openjdk-18-openjdk18-openshift Red Hat build of OpenJDK 11 openjdk-11/openjdk-11-ubi8-container, openjdk-11/openjdk-11-rhel7-container
    affected: workaround, no fix available, no fix planned “To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http.”
  • Red Hat Enterprise Linux 8 sisu, guava, jansi, jsoup, maven, slf4j, +49 more Red Hat Enterprise Linux 9 sisu, guava, jansi, maven, slf4j, jsr-305, +27 more
    affected: workaround, no fix planned “To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http.”
  • Red Hat Fuse 7 maven-core, fuse-7/fuse-ignite-s2i-container, fuse-7/fuse-ignite-meta-container, fuse-7/fuse-eap-openshift-container, fuse-7/fuse-ignite-server-container, fuse-7/fuse-java-openshift-container, +1 more Red Hat Integration Camel Quarkus 1 maven-core
    affected: workaround, no fix available “To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http.”
  • Red Hat JBoss BRMS 5 maven
    affected: workaround, no fix planned “To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http.”
  • Red Hat JBoss Fuse 6 jboss-fuse-6-fis-java-openshift jboss-fuse-6-fis-java-openshift, jboss-fuse-6-fis-karaf-openshift jboss-fuse-6-fis-karaf-openshift
    affected: workaround, no fix available “To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http.”
  • Red Hat JBoss SOA Platform 5 maven
    affected: workaround, no fix planned “To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http.”
  • Red Hat OpenShift Container Platform 4 jenkins-2-plugins Red Hat Process Automation 7 rhpam-7/rhpam-7-kieserver-rhel8-container, rhpam-7/rhpam-7-controller-rhel8-container, rhpam-7/rhpam-7-businesscentral-monitoring-rhel8-container
    affected: workaround, no fix available “To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http.”
  • Red Hat Software Collections rh-maven36-maven, rh-maven36-maven-lib, rh-maven36-maven-javadoc
    affected: workaround, no fix planned “To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http.”
show 8 more
  • Red Hat OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins 4.11.1683009941-1.el8
    fixed: vendor fix “To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http.” RHSA-2023:3198
  • Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins 4.12.1706515741-1.el8
    fixed: vendor fix “To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http.” RHSA-2024:0778
  • Red Hat OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins 4.13.1706516346-1.el8
    fixed: vendor fix “To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http.” RHSA-2024:0776
  • Red Hat build of Quarkus 2.2.3
    fixed: vendor fix “To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http.” RHSA-2021:3880
  • Red Hat RHINT Camel-K 1.6.4
    fixed: vendor fix “To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http.” RHSA-2022:1029
  • Red Hat RHINT Camel-Q 2.2.1
    fixed: vendor fix “To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http.” RHSA-2022:1013
  • Red Hat RHPAM 7.13.1 async
    fixed: vendor fix “To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http.” RHSA-2023:1334
  • Red Hat OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins 2.387.1.1683009763-3.el8 Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins 2.426.3.1706515686-3.el8 Red Hat OpenShift Developer Tools and Services for OCP 4.13 jenkins 2.426.3.1706516254-3.el8 Red Hat JBoss Enterprise Application Platform 6 maven
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

8.69% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • whitesourcesoftware.com https://www.whitesourcesoftware.com/resources/blog/maven-security-vulnerability-cve-2021-26291/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N
OSV 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.apache.maven:maven-compat
<3.8.1
3.8.1
maven org.apache.maven:maven-core
<3.8.1
3.8.1
bitnami maven
<3.8.1
3.8.1

Affected products

  • Apache Software Foundation Apache Maven

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.