9.1

CVE-2026-41869

Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)

Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server  (Nutch REST API).



This issue affects Apache Nutch: from 1.10 through 1.22.



Users are recommended to upgrade to version 1.23, which removes the Nutch Server.
If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.
Please, also visit the  Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Nutch Version >= 1.10 < 1.23
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.77% 0.536
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE-404 Improper Resource Shutdown or Release

The product does not release or incorrectly releases a resource before it is made available for re-use.

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://lists.apache.org/thread/ps4yhlvo6kdgmksdgb9lv1h4p0oy5fdj
Vendor Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2026/09/08/3
Third Party Advisory
Mailing List