Vulnerability record · CVE-2026-41869 · published 9 September 2026

CVE-2026-41869: Apache nutch improper resource shutdown vulnerability

Apache · Nutch

Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

9.1 CVSS 3.1 Critical EPSS 0.72% · top 48.0% CWE-404 · Improper resource shutdownCWE-862 · Missing authorization

9.1CVSS 3.1 base score

0.72%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

10 Sep 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Nutch Apache

References

Link	Tags
https://lists.apache.org/thread/ps4yhlvo6kdgmksdgb9lv1h4p0oy5fdj	Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/08/3	Mailing ListThird Party Advisory

Track CVE-2026-41869 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-41871Apache nutch missing authorization vulnerabilityMissing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch…EPSS 0.75%9 Sep 2026 9.8CVE-2016-6809Apache nutch deserialization of untrusted data vulnerabilityApache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to d…EPSS 8.0%6 Apr 2017 9.1CVE-2021-23901Apache nutch xml external entity (xxe) vulnerabilityAn XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML externa…EPSS 4.4%25 Jan 2021 8.8CVE-2026-41870Apache nutch code injection vulnerabilityMissing Authorization, Improper Control of Generation of Code ('Code Injection'), Improper Control of Dynamically-Managed Code Resources, Use of Exte…EPSS 0.66%9 Sep 2026 7.8CVE-2018-8639Windows Win32k memory handling flaw allows privilege elevationThe Win32k component in Windows fails to properly handle objects in memory, creating an elevation of privilege vulnerability. It affects a broad rang…KEVEPSS 22%analysed12 Dec 2018 7.8CVE-2018-8611Windows Kernel Memory Handling Elevation of PrivilegeThe Windows kernel fails to properly handle objects in memory, allowing a local attacker to elevate privileges. The flaw affects a broad set of Windo…KEVEPSS 4.2%analysed12 Dec 2018 7.8CVE-2018-8406Microsoft DirectX Graphics Kernel driver elevation of privilegeThe DirectX Graphics Kernel (DXGKRNL) driver mishandles objects in memory, allowing a local attacker to elevate privileges. It affects Windows 10, Wi…KEVEPSS 3.4%analysed15 Aug 2018 7.8CVE-2018-8405Microsoft DirectX Graphics Kernel driver elevation of privilegeThe DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, allowing an elevation of privilege on affected Windows client and …KEVEPSS 3.4%analysed15 Aug 2018

Source: NIST National Vulnerability Database (record CVE-2026-41869), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.