CVE-2026-114442
Last modified
CVE-2026-114442 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressions through metrics.aliasFields that are evaluated without the validation applied to parseScript. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressions through metrics.aliasFields that are evaluated without the validation applied to parseScript. When processing a crafted XML response, repeated evaluation may consume excessive CPU resources and impair collector availability. This is a follow-up to the incomplete fix for CVE-2026-24343. The fix is included in Apache HertzBeat 1.9.1. Users should upgrade to 1.9.1 or a later version.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache HertzBeat | 1.7.1; 1.7.2; 1.7.3; 1.8.0; 1.9.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-114442?
How severe is CVE-2026-114442?
How do I fix CVE-2026-114442?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-114431The Enable Media Replace WordPress plugin before 4.2.3 does …6.4
- CVE-2026-114437In the Golang Chi web framework, the ClientIPFromXFF middlew…4.8
- CVE-2026-114438A flaw was found in the Update User Locale required action o…4.2
- CVE-2026-114439A vulnerability was determined in oretnom23 php-travel-agenc…7.3
- CVE-2026-114440A vulnerability was identified in oretnom23 php-travel-agenc…7.3
- CVE-2026-114441A weakness has been identified in oretnom23 php-travel-agenc…7.3
- CVE-2026-114443The Security Plugin, Firewall & Malware Scanner with Auto Re…7.5
- CVE-2026-114444The Security Plugin, Firewall & Malware Scanner with Auto Re…4.4
- CVE-2026-114456Multiple Snowflake client drivers implementing the `authenti…6.5
- CVE-2026-114457A flaw was found in mod_qos. An unauthenticated remote attac…3.7
- CVE-2026-114458A flaw was found in mod_qos. An unauthenticated remote attac…5.9
- CVE-2026-114459A flaw was found in mod_qos. When inspecting HTTP response b…3.7
Are you affected by CVE-2026-114442?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST