What’s Vulnerable › Vulnerabilities

CVE-2026-41869: Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-09 · updated 2026-09-10
• Weakness: CWE-404

Description

Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

Affected products

• Apache Software Foundation Apache Nutch: from 1.10 before 1.23 — fixed in 1.23

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Nutch 1.23. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/ps4yhlvo6kdgmksdgb9lv1h4p0oy5fdj
• http://www.openwall.com/lists/oss-security/2026/09/08/3

Get alerted when CVE-2026-41869 or the next vulnerability affects your stack