Apache HertzBeat incomplete XPath validation in aliasFields
Low severity vulnerability in Apache HertzBeat versions 1.7.1 to 1.9.1 allows authenticated users to supply malicious XPath expressions.
40
Vulnerability2 · 2 reads
CVE-2026-114442
XPath validation bypass in Apache HertzBeat aliasFields before 1.9.1
- CVSS 3.1
- 6.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache HertzBeat's HTTP collector has incomplete XPath expression validation in the XML parsing path for metrics.aliasFields. An authenticated user with monitor template creation permissions can supply malicious XPath expressions, causing excessive CPU usage and collector downtime. This affects all users on versions 1.7.1 through 1.9.0.
What to do: Upgrade to Apache HertzBeat 1.9.1 or later. No workaround provided.
| Product | Affected | Fixed in |
|---|---|---|
| Apache HertzBeat | 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 | 1.9.1 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressions through metrics.aliasFields that are evaluated without the validation applied to parseScript. When processing a crafted XML response, repeated evaluation may consume excessive CPU resources and impair collector availability. This is a follow-up to the incomplete fix for CVE-2026-24343. The fix is included in Apache HertzBeat 1.9.1. Users should upgrade to 1.9.1 or a later version.
- Weakness
- CWE-643
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H