Summary

On June 17, 2026, a subset of Harness Hosted CI customers experienced intermittent build failures when downloading Java/Gradle dependencies from Maven Central. Affected builds failed with 429 Too Many Requests errors and could not proceed until the issue was resolved.

The incident was not caused by a Harness code change or platform defect. It was triggered by a policy change implemented by Sonatype (the operator of Maven Central) that tightened IP-based rate limits for unauthenticated access. Because Harness Hosted CI routes builds through shared network egress infrastructure, the aggregate outbound traffic from multiple customers sharing a common IP address exceeded the new, lower thresholds — causing all builds behind that IP to be temporarily blocked.

This was an industry-wide change. Other CI/CD platforms experienced identical incidents in the weeks prior to Harness being affected.

Root Cause

Primary cause: Sonatype tightened IP-based rate limiting policies on Maven Central (repo1.maven.org and repo.maven.apache.org). Harness Hosted CI uses shared network egress infrastructure where multiple customer build environments route outbound traffic through common IP addresses. When the aggregate Maven Central request volume from all customers behind a given IP exceeded Sonatype's revised threshold, that IP was hard-blocked for approximately 30 minutes, causing all builds attempting to download Maven dependencies to fail with 429 errors.

‌

Mitigation

Immediate actions taken during the incident:

1. Regional redistribution: For customers experiencing active failures, builds were routed to infrastructure regions whose outbound IPs had not yet hit the rate limit threshold, providing immediate relief for those customers.
2. Sonatype engagement and IP whitelisting: The Harness team contacted Sonatype support and provided the full list of Harness Hosted CI outbound IP addresses for whitelisting. Sonatype applied a "warning" rate-limit policy in place of hard blockingeliminating the 429 errors across all affected regions. Post-mitigation validation confirmed zero throttling across all tested IPs.

Next Steps

The following actions are in progress or planned to prevent recurrence and reduce exposure to similar incidents:

Near-term (in progress):

• Harness is in the process of establishing a commercial agreement with Sonatype for elevated rate limits on Maven Central and advance notification of future policy changes.
• Harness is engaging other major dependency registries — including Docker Hub, npm, GitHub Packages, and the Gradle Plugin Portal — to proactively whitelist Harness egress IPs before similar incidents can occur.
• We are publishing documentation on best practices for managing external dependency access in Hosted CI, including guidance on dependency proxies, mirrors, and caching strategies.
• Harness plans to implement caching infrastructure for common dependencies at the platform level (using Harness Artifact Registry), which will significantly reduce direct Maven Central request volume and provide resilience against future external rate-limit changes.
• We are enhancing our alerting alerting for 429 error patterns from external registries so that future rate-limit incidents are detected internally before customers are impacted.

‌

What This Means for You

To reduce future exposure, we recommend:

• Enable Cache Intelligence in Harness CI to cache dependency artifacts between builds, reducing how often Maven Central is contacted.
• Use Harness Save/Restore Cache steps to persist your local dependency cache across pipeline runs.

If you have questions or need help implementing any of these recommendations, please contact your Customer Success Manager or reach out to Harness Support.