CVE-2026-41869

CRITICAL 9.1

Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)

CVSS Score

9.1

EPSS Score

0.0%

EPSS Percentile

0th

Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

CWE	CWE-862 CWE-404
Vendor	apache software foundation
Product	apache nutch
Published	Sep 9, 2026
Last Updated	Sep 10, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache nutch

Be the first to know when new critical vulnerabilities affecting apache software foundation apache nutch are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Nutch

1.10 ≤ 1.22

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/ps4yhlvo6kdgmksdgb9lv1h4p0oy5fdj openwall.com: http://www.openwall.com/lists/oss-security/2026/09/08/3

Credits

🔍 The Apache Nutch Project Management Committee would like to thank Th1nk for reporting this issue.