CVE-2026-114442: vulnerability in Apache HertzBeat
Apache HertzBeat: incomplete XPath expression validation in aliasFields
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.2%
Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressions through metrics.aliasFields that are evaluated without the validation applied to parseScript. When processing a crafted XML response, repeated evaluation may consume excessive CPU resources and impair collector availability. This is a follow-up to the incomplete fix for CVE-2026-24343. The fix is included in Apache HertzBeat 1.9.1. Users should upgrade to 1.9.1 or a later version.
Affected products
Apache Software Foundation · Apache HertzBeatRelated CVEs — Apache HertzBeat
In the same product, most dangerous first.
CVE-2024-42323HIGHApache HertzBeat: RCE by snakeYaml deser load malicious xmlEPSS 8.3%CVE-2024-45505HIGHApache HertzBeat: Exists Native Deser RCE and file writing vulnerabilitiesEPSS 2.2%CVE-2024-41151HIGHApache HertzBeat: RCE by notice template injection vulnerabilityEPSS 1.0%CVE-2024-45791HIGHApache HertzBeat: Exposure sensitive token via http GET method with query stringEPSS 0.8%CVE-2026-24343HIGHApache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath ExpressionsEPSS 0.8%CVE-2024-56736MEDIUMApache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config OssEPSS 0.7%