CVE-2026-114442
Received Received - Intake

Denial of Service in Apache HertzBeat via XPath Injection

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Apache Software Foundation

Description
Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressions through metrics.aliasFields that are evaluated without the validation applied to parseScript. When processing a crafted XML response, repeated evaluation may consume excessive CPU resources and impair collector availability. This is a follow-up to the incomplete fix for CVE-2026-24343. The fix is included in Apache HertzBeat 1.9.1. Users should upgrade to 1.9.1 or a later version.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-114442
EUVD
EUVD-2026-115743

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-643 The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache HertzBeat versions 1.7.1 to 1.9.0 have an incomplete XPath validation issue in the HTTP collector XML parsing path. Authenticated users with monitor template creation permissions can provide XPath expressions via metrics.aliasFields that bypass validation applied to parseScript. This allows crafted XML responses to trigger repeated evaluations, consuming excessive CPU resources and reducing collector availability.

Detection Guidance

Check Apache HertzBeat version with: curl -s http://localhost:1157/api/version | grep version. If running versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, or 1.9.0, the system is vulnerable. Monitor CPU usage spikes during XML parsing tasks as potential indicators of exploitation attempts.

Impact Analysis

This vulnerability can lead to denial-of-service conditions where the affected system becomes unresponsive or slow due to high CPU usage. Systems running vulnerable versions may experience degraded performance or complete unavailability of monitoring services when processing malicious XML inputs.

Mitigation Strategies

Upgrade Apache HertzBeat to version 1.9.1 or later immediately. Restrict monitor template creation permissions to trusted administrators only. Review and remove any unauthorized XPath expressions in metrics.aliasFields configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114442. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...