Threat database

CVE-2026-41871 is a critical vulnerability in Apache Nutch Server's REST API affecting versions 1.10 through 1.22. It involves missing authorization and unsafe reflection, allowing unauthorized access and potentially full compromise. The vulnerability is fixed by upgrading to version 1.23, which removes the vulnerable Nutch Server component. If upgrading is not feasible, restricting access to trusted users is recommended.

Apache Nutch versions 1.10 through 1.22 contain a critical vulnerability involving missing authorization in the Nutch Server REST API. This flaw allows unauthorized access to the service, leading to potential information disclosure and denial of service due to improper resource shutdown and job interruption. The vulnerability is addressed by removing the Nutch Server in version 1.23. Users unable to upgrade should restrict access to trusted users only.

CVE-2026-41870 is a high severity vulnerability in Apache Nutch versions 1.11 through 1.22 affecting the Nutch REST API. It involves missing authorization controls, leading to risks such as code injection, unsafe reflection, and improper control of dynamically managed code resources. The vulnerability allows unauthorized users with limited privileges to potentially execute harmful actions. Apache Nutch 1.23 removes the vulnerable Nutch Server component, mitigating this issue. Users unable to upgrade should restrict access to trusted users only.