XPath Expression Validation Flaw in Apache HertzBeat

CVE-2026-114442

What is CVE-2026-114442?

Apache HertzBeat versions 1.7.1 through 1.9.0 are affected by a vulnerability due to inadequate validation of XPath expressions during HTTP collector XML parsing. An authenticated user with permissions to create monitor templates can exploit this flaw by supplying crafted XPath expressions through metrics.aliasFields. This may lead to excessive CPU resource consumption, impacting the availability of the collector. Users are advised to update to Apache HertzBeat version 1.9.1 or later, which includes a fix for this issue.

References