Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
CRITICAL severity

CVE-2021-26291 — maven-compat

CRITICALFix: apache/maven@899465a

CVE-2021-26291 is a critical-severity (CVSS 9.1) CWE-346 vulnerability in org.apache.maven:maven-compat. 1 public exploit reference exists, so weaponization risk is real. A fix is available for org.apache.maven:maven-compat — see the affected versions and patch details below.

Origin Validation Error in Apache Maven

Also known asBIT-maven-2021-26291GHSA-2f88-5hg8-9x2x
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
1 known
Exploitation data as of Oct 12, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
8.7%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs95th percentile — riskier than 95% of all scored CVEsHighest risk
0.00%19.1%38.2%57.3%46.1%8.7%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2021-26291 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 385,987 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

2 pkgs affected
☕org.apache.maven:maven-compat☕org.apache.maven:maven-core

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.apache.maven:maven-compatall versions3.8.1org.apache.maven:maven-compat:3.8.1
☕Mavenorg.apache.maven:maven-coreall versions3.8.1org.apache.maven:maven-core:3.8.1

Affected Products

4 products · 5 configurations
Application
mavenapache
< 3.8.1
range
Application
financial services analytical applications infrastructureoracle
≥ 8.1.0.0.0 && ≤ 8.1.2.0
range
Application
goldengate big data and application adaptersoracle
1 version
23.1
Application
quarkusquarkus
< 1.13.5
range
Exploits & PoCs
1

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

Apache Maven will follow repositories that are defined in a dependency’s…

whitesourcesoftware.comNVDAug 2021

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.maven:maven-compat, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.apache.maven:maven-compat to 3.8.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2021-26291 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant
Workaround published by Red Hat
To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http.
Source: Red Hat security advisory for CVE-2021-26291 (CC BY 4.0)
ProductFixed inAdvisory
OCP-Tools-4.12-RHEL-8jenkins-2-plugins-0:4.12.1706515741-1.el8RHSA-2024:0778
OCP-Tools-4.13-RHEL-8jenkins-2-plugins-0:4.13.1706516346-1.el8RHSA-2024:0776
OpenShift Developer Tools and Services for OCP 4.11jenkins-2-plugins-0:4.11.1683009941-1.el8RHSA-2023:3198
Red Hat build of Quarkus 2.2.3maven-wrapperRHSA-2021:3880
RHINT Camel-K 1.6.4maven-coreRHSA-2022:1029
RHINT Camel-Q 2.2.1see advisoryRHSA-2022:1013
RHPAM 7.13.1 asyncrhpam-7-businesscentral-rhel8-containerRHSA-2023:1334
UbuntuCRITICAL
USN-5245-1UbuntuUSN-5805-1Ubuntu

Frequently Asked Questions

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in
O3 Security · Impact-Aware SCA

Is CVE-2021-26291 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2021-26291: maven-compat — Fixed in 3.8.1