Baike.dev
Log in
Back to tool/Back to issues
#9471·OWASP ZAP

Modern spider doesn't respect the specified time limit

Author: alexkiroCreated Sep 18, 2026Updated Sep 18, 2026
Labelsbug

Describe the bug:

When running zap-full-scan using the modern spider and time limit the time limit is not respected. I've attached some logs showing the issue, where I specified 5 minute time limit for the spider. However the spider took ~100 minutes more than the alloted time.

Steps to reproduce the behavior:

  • start zap-full-scan.py with the modern spider activated -j and a time limit for the spider -m
  • wait for the spider to complete
  • the spider takes way longer than the time limit specified

Expected behavior:

The spider should stop after the specified time.

Software Versions:

Running in docker image 

        "Id": "sha256:6175579a46d477338e4b641dd9c3428936f30c3719809e2f4d36f58e60c4ddb7",
        "RepoTags": [
            "ghcr.io/zaproxy/zaproxy:stable"
        ],
        "RepoDigests": [
            "ghcr.io/zaproxy/zaproxy@sha256:781a2bdaea47324e7bab583e2263f21d257b0aee61ed51521a5be45f5f5081ef"
        ],

Zap version

zap@09cf1f8275a8:/zap$ zap.sh -suppinfo
Found Java version 17.0.20
Available memory: 15894 MB
Using JVM args: -Xmx3973m
ZAP
Version: 2.17.0
Installed Add-ons: [[id=alertFilters, version=27.0.0], [id=ascanrules, version=83.0.0], [id=ascanrulesBeta, version=66.0.0], [id=authhelper, version=0.42.0], [id=automation, version=0.60.0], [id=bruteforce, version=21.0.0], [id=callhome, version=0.23.0], [id=client, version=0.31.0], [id=commonlib, version=1.44.0], [id=database, version=0.9.0], [id=diff, version=18.0.0], [id=directorylistv1, version=9.0.0], [id=domxss, version=24.0.0], [id=encoder, version=1.9.0], [id=exim, version=0.22.0], [id=formhandler, version=6.8.0], [id=fuzz, version=13.17.0], [id=gettingStarted, version=20.0.0], [id=graaljs, version=0.14.0], [id=graphql, version=0.34.0], [id=help, version=22.0.0], [id=hud, version=0.19.0], [id=insights, version=0.5.0], [id=invoke, version=17.0.0], [id=network, version=0.29.0], [id=oast, version=0.26.0], [id=onlineMenu, version=15.0.0], [id=openapi, version=58.0.0], [id=postman, version=0.10.0], [id=pscan, version=0.6.0], [id=pscanrules, version=75.0.0], [id=pscanrulesBeta, version=50.0.0], [id=quickstart, version=59.0.0], [id=replacer, version=22.0.0], [id=reports, version=0.46.0], [id=requester, version=7.10.0], [id=retest, version=0.11.0], [id=retire, version=0.66.0], [id=reveal, version=10.0.0], [id=scanpolicies, version=0.8.0], [id=scripts, version=45.20.0], [id=selenium, version=15.56.0], [id=sequence, version=10.0.0], [id=soap, version=32.0.0], [id=spider, version=0.20.0], [id=spiderAjax, version=23.32.0], [id=tips, version=16.0.0], [id=webdriverlinux, version=223.0.0], [id=websocket, version=38.0.0], [id=zest, version=48.14.0]]
Operating System: Linux
Architecture: amd64
CPU Cores: 6
Max Memory: 3 GB
Java Version: Debian 17.0.20
System's Locale: en
Display Locale: en_GB
Format Locale: en_GB
Default Charset: UTF-8
ZAP Home Directory: /home/zap/.ZAP/
ZAP Installation Directory: /zap/./
Look and Feel: Metal (javax.swing.plaf.metal.MetalLookAndFeel)

Screenshots:

No response

Errors from the zap.log file:

$ zap-full-scan.py -j -d -m 5 -t http://nginx/api/ -r zap-report.html -J zap-report.json
2026-09-18 05:40:23,961 Target: http://nginx/api/
2026-09-18 05:40:23,962 Trigger hook: cli_opts, args: 1
2026-09-18 05:40:23,962 Using port: 43834
2026-09-18 05:40:23,962 Trigger hook: start_zap, args: 2
2026-09-18 05:40:23,962 Starting ZAP
2026-09-18 05:40:23,962 Params: ['/zap/zap-x.sh', '-daemon', '-port', '43834', '-host', '0.0.0.0', '-config', 'database.recoverylog=false', '-config', 'api.disablekey=true', '-config', 'api.addrs.addr.name=.*', '-config', 'api.addrs.addr.regex=true', '-config', 'spider.maxDuration=5', '-config', 'stats.pkg.fullscan-api=1', '-addonupdate', '-addoninstall', 'pscanrulesBeta', '-addoninstall', 'ascanrulesBeta']
2026-09-18 05:40:23,963 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:24,965 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:25,966 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:26,968 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:27,969 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:28,972 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:29,974 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:30,978 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:31,019 http://localhost:43834 "GET http://zap/JSON/core/view/version/ HTTP/1.1" 200 20
2026-09-18 05:40:31,020 ZAP Version 2.17.0
2026-09-18 05:40:31,020 Took 7 seconds
2026-09-18 05:40:31,020 Trigger hook: zap_started, args: 2
2026-09-18 05:40:31,020 Tune
2026-09-18 05:40:31,020 Disable all tags
2026-09-18 05:40:31,020 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:31,025 http://localhost:43834 "GET http://zap/JSON/pscan/action/disableAllTags/ HTTP/1.1" 200 15
2026-09-18 05:40:31,026 Set max pscan alerts
2026-09-18 05:40:31,026 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:31,031 http://localhost:43834 "GET http://zap/JSON/pscan/action/setMaxAlertsPerRule/?maxAlerts=10 HTTP/1.1" 200 15
2026-09-18 05:40:31,031 Trigger hook: zap_tuned, args: 1
2026-09-18 05:40:31,031 Trigger hook: zap_access_target, args: 2
2026-09-18 05:40:31,032 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:31,058 http://localhost:43834 "GET http://nginx/api/ HTTP/1.1" 404 179
2026-09-18 05:40:33,059 Trigger hook: zap_spider, args: 2
2026-09-18 05:40:33,059 Spider http://nginx/
2026-09-18 05:40:33,062 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:33,076 http://localhost:43834 "GET http://zap/JSON/spider/action/scan/?url=http%3A%2F%2Fnginx%2F HTTP/1.1" 200 12
2026-09-18 05:40:38,077 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:38,082 http://localhost:43834 "GET http://zap/JSON/spider/view/status/?scanId=0 HTTP/1.1" 200 16
2026-09-18 05:40:38,082 Spider complete
2026-09-18 05:40:38,082 Trigger hook: zap_spider_wrap, args: 1
2026-09-18 05:40:38,082 Trigger hook: zap_client_spider, args: 3
2026-09-18 05:40:38,083 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:38,085 http://localhost:43834 "GET http://zap/JSON/clientSpider/action/setOptionMaxDuration/?Integer=5 HTTP/1.1" 200 15
2026-09-18 05:40:38,085 Client Spider http://nginx/
2026-09-18 05:40:38,086 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:38,097 http://localhost:43834 "GET http://zap/JSON/clientSpider/action/scan/?url=http%3A%2F%2Fnginx%2F HTTP/1.1" 200 12
2026-09-18 05:40:43,098 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:43,125 http://localhost:43834 "GET http://zap/JSON/clientSpider/view/status/?scanId=0 HTTP/1.1" 200 14
2026-09-18 05:40:43,126 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:43,129 http://localhost:43834 "GET http://zap/JSON/clientSpider/view/status/?scanId=0 HTTP/1.1" 200 14
2026-09-18 05:40:43,129 Client Spider progress %: 0
2026-09-18 05:40:48,131 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:48,132 http://localhost:43834 "GET http://zap/JSON/clientSpider/view/status/?scanId=0 HTTP/1.1" 200 15
2026-09-18 05:40:48,133 Starting new HTTP connection (1): localhost:43834
2026-09-18 05:40:48,138 http://localhost:43834 "GET http://zap/JSON/clientSpider/view/status/?scanId=0 HTTP/1.1" 200 15
2026-09-18 05:40:48,140 Client Spider progress %: 10
[..................]
2026-09-18 07:25:44,152 http://localhost:43834 "GET http://zap/JSON/clientSpider/view/status/?scanId=0 HTTP/1.1" 200 15
2026-09-18 07:25:44,153 Client Spider progress %: 99
2026-09-18 07:25:49,156 Starting new HTTP connection (1): localhost:43834
2026-09-18 07:25:49,159 http://localhost:43834 "GET http://zap/JSON/clientSpider/view/status/?scanId=0 HTTP/1.1" 200 16
2026-09-18 07:25:49,160 Client Spider complete
2026-09-18 07:25:49,160 Trigger hook: zap_client_spider_wrap, args: 1
2026-09-18 07:25:49,160 Trigger hook: zap_active_scan, args: 3
2026-09-18 07:25:49,160 Active Scan http://nginx/ with policy Default Policy

Additional context:

No response

Would you like to help fix this issue?

  • Yes

Source: zaproxy/zaproxy

View original on GitHubView discussion on GitHub