CVE-2026-114442

The record

Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressions through metrics.aliasFields that are evaluated without the validation applied to parseScript. When processing a crafted XML response, repeated evaluation may consume excessive CPU resources and impair collector availability. This is a follow-up to the incomplete fix for CVE-2026-24343. The fix is included in Apache HertzBeat 1.9.1. Users should upgrade to 1.9.1 or a later version.

Affected packages

Related vulnerabilities

• CVE-2026-93434 An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process… CWE-643
• CVE-2026-9390 XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. CWE-643
• CVE-2026-44962 Plesk contains an XPath injection vulnerability in the APS Application Catalog search… CWE-643
• CVE-2026-40699 A vulnerability exists in the undisclosed pages in the Configuration utility that may… CWE-643
• CVE-2026-24343 Improper Neutralization of Data within XPath Expressions ('XPath Injection')… CWE-643
• GHSA-r7vr-wg3f-8hr9 Concrete5 CMS contains an XPath injection vulnerability CWE-643
• CVE-2022-50807 Concrete5 CMS contains an XPath injection vulnerability CWE-643