Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-41869: Apache Nutch server can be stopped by anyone

CVE-2026-41869 · published 1 month ago

Summary

The Nutch web‑crawling service (versions 1.10 to 1.22) allows anyone to send a request that shuts down the server or interrupts running jobs. This can disrupt data collection and cause downtime. Upgrade to version 1.23 (which removes the server component) or limit access to the service to trusted users only.

What to do

Update apache nutch to version 1.23 or later.

Affected software

Vendor	Product	Affected versions
apache software foundation	apache nutch	<= 1.22
apache	nutch	>= 1.10, < 1.23 `cpe:2.3:a:apache:nutch::::::::`

Original advisory text

Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)

Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API).

This issue affects Apache Nutch: from 1.10 through 1.22.

Users are recommended to upgrade to version 1.23, which removes the Nutch Server.
If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.
Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

References

https://lists.apache.org/thread/ps4yhlvo6kdgmksdgb9lv1h4p0oy5fdj Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/08/3 Mailing List Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

9.1 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-404Improper Resource Shutdown or Release

CWE-862Missing Authorization

Timeline

Published9 Sep 2026

Updated7 Oct 2026

First seen9 Sep 2026

Sources

CVE-2026-41869 · NVD

CVE-2026-41869 · MITRE

Track software like this

Free during beta