This is an automated email from the ASF dual-hosted git repository.
sebastian-nagel pushed a commit to branch asf-staging
in repository https://gitbox.apache.org/repos/asf/nutch-site.git
The following commit(s) were added to refs/heads/asf-staging by this push:
new ecacbc5d Update CVE list after release of Nutch 1.23
ecacbc5d is described below
commit ecacbc5db76f0f82ba20e59dd4d6aeb06d37b4a4
Author: Sebastian Nagel <[email protected]>
AuthorDate: Tue Sep 8 13:07:24 2026 +0200
Update CVE list after release of Nutch 1.23
---
content/documentation/security/index.html | 95 +++++++++++++++++++------------
1 file changed, 58 insertions(+), 37 deletions(-)
diff --git a/content/documentation/security/index.html
b/content/documentation/security/index.html
index 08ef15e9..435457a9 100644
--- a/content/documentation/security/index.html
+++ b/content/documentation/security/index.html
@@ -61,43 +61,43 @@
<body class="page-kube">
- <header> <div class="show-sm">
- <div id="nav-toggle-box">
- <div id="nav-toggle-brand">
- <a href="/">Apache Nutch™</a>
- </div><a data-component="toggleme" data-target="#top" href="#"
id="nav-toggle"><i class="kube-menu"></i></a>
- </div>
- </div>
- <div class="hide-sm" id="top">
- <div id="top-brand">
- <a href="/" title="home">Apache Nutch™</a>
- </div>
- <nav id="top-nav-main">
- <ul>
-
-
- <li><a href="/community/" >Community</a></li>
-
- <li><a href="/development/" >Development</a></li>
-
- <li><a href="/documentation/security" >Security</a></li>
-
- <li><a href="/documentation/" >Docs</a></li>
-
- <li><a href="/download/" >Download</a></li>
-
- <li><a href="/news/" >News</a></li>
-
- <li><a href="/apache/" >The Apache Software Foundation</a></li>
-
- </ul>
- </nav>
- <nav id="top-nav-extra">
- <ul>
-
- </ul>
- </nav>
- </div>
+ <header> <div class="show-sm">
+ <div id="nav-toggle-box">
+ <div id="nav-toggle-brand">
+ <a href="/">Apache Nutch™</a>
+ </div><a data-component="toggleme" data-target="#top" href="#"
id="nav-toggle"><i class="kube-menu"></i></a>
+ </div>
+ </div>
+ <div class="hide-sm" id="top">
+ <div id="top-brand">
+ <a href="/" title="home">Apache Nutch™</a>
+ </div>
+ <nav id="top-nav-main">
+ <ul>
+
+
+ <li><a href="/community/" >Community</a></li>
+
+ <li><a href="/development/" >Development</a></li>
+
+ <li><a href="/documentation/security" >Security</a></li>
+
+ <li><a href="/documentation/" >Docs</a></li>
+
+ <li><a href="/download/" >Download</a></li>
+
+ <li><a href="/news/" >News</a></li>
+
+ <li><a href="/apache/" >The Apache Software Foundation</a></li>
+
+ </ul>
+ </nav>
+ <nav id="top-nav-extra">
+ <ul>
+
+ </ul>
+ </nav>
+ </div>
</header>
<main>
@@ -139,6 +139,27 @@
<li>See the section about the <a href="#nutch-server-and-rest-api">Nutch
Server and REST API</a>.</li>
</ul>
<h1 id="nutch-cve-list">Nutch CVE List</h1>
+<h2 id="cve-2026-41871"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-41871";>CVE-2026-41871</a></h2>
+<p>Unauthenticated reflection-based job execution in Nutch Server (Nutch REST
API)</p>
+<p>Type: Missing Authorization (CWE-862), Unsafe Reflection (CWE-470)<br/>
+Affects Nutch version (up to): 1.22<br/>
+Fixed Nutch version: 1.23<br/>
+Publicly announced on <a
href="https://lists.apache.org/thread/gb6z4h3wbhbhmyx7hjjdngbpc3fpw78q";>2026-09-08</a><br/>
+Reporter / Thanks To: Th1nk</p>
+<h2 id="cve-2026-41870"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-41870";>CVE-2026-41870</a></h2>
+<p>Unauthenticated remote code execution (RCE) via JEXL injection in Nutch
Server (Nutch REST API)</p>
+<p>Type: Missing Authorization (CWE-862), Code Injection (CWE-94)<br/>
+Affects Nutch version (up to): 1.22<br/>
+Fixed Nutch version: 1.23<br/>
+Publicly announced on <a
href="https://lists.apache.org/thread/6gqd09ntfj31frnpvc0j8tvls3vow08j";>2026-09-08</a><br/>
+Reporter / Thanks To: Th1nk</p>
+<h2 id="cve-2026-41869"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-41869";>CVE-2026-41869</a></h2>
+<p>Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch
REST API)</p>
+<p>Type: Missing Authorization (CWE-862), Improper Resource Shutdown or
Release (CWE-404)<br/>
+Affects Nutch version (up to): 1.22<br/>
+Fixed Nutch version: 1.23<br/>
+Publicly announced on <a
href="https://lists.apache.org/thread/swz0hgz8rnown4fnnkpch9qgop5t0nor";>2026-09-08</a><br/>
+Reporter / Thanks To: Th1nk</p>
<h2 id="cve-2021-23901"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2021-23901";>CVE-2021-23901</a></h2>
<p>Type: XXE injection<br/>
Affects Nutch version (up to): 1.17<br/>
