NXRM3 version: 3.41.1-01 h2 DB: 1.4.200 Current version of h2 DB contains a few critical vulnerabilities: CVE-2021-23463 CVE-2021-42392 CVE-2022-23221 It seems these are fixed in latest 2.0.206+ versions. What’s the process to get this upgraded? Is this already tracked? Regards, Atharva

Atharva, Thanks for your inquiry. We are aware of this dependency vulnerability via our continuous monitoring with Nexus Lifecycle. We consider all dependency vulnerabilities to be potentially exploitable, and we have already queued them for remediation as a routine part of our development process…

Michael, Thanks for the info. It wasn’t clear to me that the Pro announcement also applies to oss versions. I didn’t think Pro version used the h2 database. Regards Atharva

Hi @mprescott When we can expect a fix for this? Tried with the latest image and even that has this H2 database and Hazelcast critical vulnerabilities. Regards, Suganth

I modified all h2-related version numbers in the configuration file to 2.0.206, and replaced the jar package of 2.0.206. I found that nexus can start normally after I modified it. What are the disadvantages of this to the existing system?

Nexus RM3 OSS h2 vulnerability

Sonatype Nexus Repository

mpiggott (Matthew Piggott) November 27, 2023, 2:56pm 6

h2 1.4 and h2 2.x use incompatible storage formats.

Topic		Replies	Views
Sonatype Nexus Repository 3.70.0 Released Sonatype Nexus Repository nexus-repository	0	762	July 10, 2024
Migration fails from OrientDB to H2 on RHEL with nexus 3.70.1 Sonatype Nexus Repository	3	2100	August 26, 2024
Nexus H2 repair steps for version 3.79 Best Practices	3	276	March 3, 2026
Nexus 3 Compatibility and migration Sonatype Nexus Repository	4	151	October 23, 2025
Nexus Repository 3.43.0 Released Sonatype Nexus Repository nexus-repository	0	624	November 7, 2022

Nexus RM3 OSS h2 vulnerability

Related topics