The vulnerability is a missing authorization check in the Nutch REST API that allows an unauthenticated user to force a shutdown of the Nutch Server or to interrupt running jobs. This results in a denial of service by rendering the search indexing service unavailable. The weakness is reflected in CWE-404 (Improper Resource Closure) and CWE-862 (Missing Authorization). The impact is confined to the Nutch service itself; however, because the service may be part of an integrated search platform, interruption could affect downstream applications.

The flaw exists in all supported Apache Nutch releases from version 1.10 through 1.22. The product is the Apache Nutch search platform component managed by the Apache Software Foundation. Upgrade to 1.23, where the Nutch Server component has been removed, eliminates the vulnerability. Systems still running one of the affected versions without monitoring must consider mitigating access restrictions.

The formal security metrics indicate that no EPSS score is available and the vulnerability is not cataloged in CISA's KEV list. Nonetheless, the underlying REST API endpoint is reachable over the network, and the absence of authentication means that any network actor that can reach the API would immediately be able to issue shutdown or interruption commands. The likelihood of exploitation depends on exposure; a publicly reachable instance presents a high risk, while an internal, firewall‑protected instance reduces the threat but still allows local attackers to disrupt service. The primary vector appears to be unauthenticated remote exploitation of the REST API.