CVE-2026-114442 Details
Description
Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressions through metrics.aliasFields that are evaluated without the validation applied to parseScript. When processing a crafted XML response, repeated evaluation may consume excessive CPU resources and impair collector availability. This is a follow-up to the incomplete fix for CVE-2026-24343. The fix is included in Apache HertzBeat 1.9.1. Users should upgrade to 1.9.1 or a later version.
A vulnerability exists in Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0, due to incomplete validation of XPath expressions in the HTTP collector XML parsing process. This flaw allows authenticated users with the ability to create monitor templates to submit unvalidated XPath expressions through metrics.aliasFields. When these expressions are processed, they can be evaluated repeatedly, leading to excessive CPU consumption and disrupting collector availability. This issue follows an incomplete fix for CVE-2026-24343.
Users are advised to upgrade to Apache HertzBeat version 1.9.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/apache/hertzbeat/pull/4481 | [email protected] | Source CodeVendor |
| https://lists.apache.org/thread.html/5hmlvklmmw0hl9rb629hr6vxvq3pmspf | [email protected] | AdvisoryMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-643 | Improper Neutralization of Data within XPath Expressions ('XPath Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache HertzBeat | 1.7.1 (semver) 1.7.2 (semver) 1.7.3 (semver) 1.8.0 (semver) 1.9.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |