CVE-2026-114442— Apache HertzBeat: incomplete XPath expression validation in aliasFields

Quick assessment

Affected

Apache Software Foundation Apache HertzBeat

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache HertzBeat 的 1.7.1、1.7.2、1.7.3、1.8.0 和 1.9.0 版本在 HTTP 采集器的 XML 解析路径中存在 XPath 表达式验证不完整的问题。拥有创建监控模板权限的已认证用户，可通过字段提供 XPath 表达式，这些表达式在评估时未应用本应施加于的验证措施。当处理经过精心构造的 XML 响应时，重复的表达式评估可能消耗大量 CPU 资源，从而影响采集器的可用性。此问题是对 CVE-2026-24343 修复不完整的后续跟进。修复方案已包含在 Apache Hert

AI Predicted 5.3 Difficulty: Moderate Updated Nov 03, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1499.003 · Application Exhaustion Flood

Updated Nov 03, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache HertzBeat: incomplete XPath expression validation in aliasFields

Source: CVE Program / CVE List V5

Vulnerability Description

Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressions through metrics.aliasFields that are evaluated without the validation applied to parseScript. When processing a crafted XML response, repeated evaluation may consume excessive CPU resources and impair collector availability. This is a follow-up to the incomplete fix for CVE-2026-24343. The fix is included in Apache HertzBeat 1.9.1. Users should upgrade to 1.9.1 or a later version.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

XPath表达式中数据转义处理不恰当(XPath注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache HertzBeat	1.7.1	-

II. Public POCs for CVE-2026-114442

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-114442

请登录查看更多情报信息。

Other References for CVE-2026-114442 (2)

https://www.cve.org/CVERecord?id=CVE-2026-114442

Same Patch Batch · Apache Software Foundation · 2026-11-03 · 3 CVEs total

CVE-2026-119641		Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership
CVE-2026-119724		Apache JClouds: XML External Entity (XXE) in provider-response parsing

IV. Related Vulnerabilities

Same product: Apache HertzBeat

Same vendor: Apache Software Foundation

Same weakness: CWE-643