# Cve-2023-4863 - open-source libwebp library

**URL:** <https://community.sonatype.com/t/cve-2023-4863-open-source-libwebp-library/11382>\
**Category:** Sonatype Nexus Repository\
**Created:** [September 29, 2023, 10:26am UTC](https://community.sonatype.com/t/cve-2023-4863-open-source-libwebp-library/11382 "2023-09-29T10:26:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jmlp1](https://avatars.discourse-cdn.com/v4/letter/j/958977/32.png) [@jmlp1](https://community.sonatype.com/u/jmlp1)\
**Post date:** [September 29, 2023, 10:26am UTC](https://community.sonatype.com/t/cve-2023-4863-open-source-libwebp-library/11382/1 "2023-09-29T10:26:32Z")

</div>

Sonatype Nexus Repository ManagerOSS 3.41.1-01

Just info if Sonatype / Nexus Repository is affected by the last vulnerability discovered in open-source libwebp library

Thanks in advance

Juan

---

<div class="post-metadata">

**Author:** ![mprescott](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/mprescott/32/178_2.png) [@mprescott](https://community.sonatype.com/u/mprescott)\
**Post date:** [September 29, 2023, 3:36pm UTC](https://community.sonatype.com/t/cve-2023-4863-open-source-libwebp-library/11382/2 "2023-09-29T15:36:40Z")

</div>

Hello @jmlp1 . We don’t disclose the specific exploitability of potential vulnerabilities in Sonatype Nexus Repository; we treat all vulnerabilities in our open source dependencies as potentially exploitable, and we schedule them all for removal or upgrade to a non-vulnerable version.

3.41.1 is more than a year old at this point, we would normally recommend you upgrade to a much more recent version. Versions this old are at risk of being significantly out of date in terms of security updates.