Executive brief
Apache Nutch is an open-source web crawler used for large-scale indexing and search applications. The Nutch Server REST API lacks proper authorization checks, allowing unauthenticated attackers to forcefully shut down the service or interrupt active indexing jobs. This can cause operational disruption and data loss in search and crawling infrastructure that depends on Nutch.
Technical details
The vulnerability is a missing authorization flaw in the Apache Nutch Server REST API endpoints that control resource shutdown and job interruption. Affected versions 1.10 through 1.22 do not properly validate user permissions before allowing callers to terminate the service or cancel jobs. The attack requires network access to the REST API but does not require authentication; an unauthenticated attacker can trigger service shutdown or job cancellation, causing availability and data integrity issues. Apache Nutch 1.23 removes the Nutch Server entirely to address this issue; for earlier versions, access should be restricted to trusted networks only.
Affected products
- Apache Nutch 1.10 through 1.22
Timeline
- 2026-09-08: disclosed
- 2026-09-09: advisory