Sonatype Nexus Repository Vulnerability Disclosure

generated: '2026-11-05'
method: searched
probe: false
source:
- https://www.sonatype.com/report-a-security-vulnerability
- https://help.sonatype.com/en/responsible-disclosure.html
- https://help.sonatype.com/en/sonatype-security-vulnerabilities.html
- https://trust.sonatype.com/
policy:
- https://www.sonatype.com/report-a-security-vulnerability
- https://help.sonatype.com/en/responsible-disclosure.html
contact:
- mailto:security@sonatype.com
- https://www.sonatype.com/report-a-security-vulnerability
bug_bounty:
  platform: HackerOne
  program: private
  how: Request an invitation by emailing security@sonatype.com; anonymous submissions accepted via the form on the report
    page.
  url: https://www.sonatype.com/report-a-security-vulnerability
disclosure_timeline: Sonatype gives maintainers 90 days from first contact to patch before publishing to the National Vulnerability
  Database (responsible-disclosure page).
advisories:
- https://www.sonatype.com/security-advisories
- https://support.sonatype.com/hc/en-us/sections/203012668-Security-Advisories
evidence:
- source: https://www.sonatype.com/report-a-security-vulnerability
  http_status: 200
  quote: Sonatype operates a private bug bounty program through HackerOne. The recommended way to report a vulnerability is
    to request an invitation to our private HackerOne program before submitting your report. To request an invitation, please
    email security@sonatype.com
- source: https://help.sonatype.com/en/responsible-disclosure.html
  http_status: 200
  quote: From the first date of contact between Sonatype and the project maintainers, the project has 90 days to provide a
    patch.
- source: https://trust.sonatype.com/
  http_status: 200
  quote: Security at Sonatype | Bug Bounty Program | Security Advisories security@sonatype.com
security_txt: https://www.sonatype.com/.well-known/security.txt returned 404 on 2026-11-05 (the well-known harvest probes
  every host).