PT-2026-7141 · Apache · Apache Hertzbeat

Qingran Zhao · Publicado 2026-02-09 · Atualizado 2026-02-11 · CVE-2026-24343

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache HertzBeat versions 1.7.1 through 1.7.9

Description An issue exists in Apache HertzBeat related to improper neutralization of data within XPath expressions, potentially leading to XPath Injection. This could allow for crafted XPath expressions to cause uncontrolled resource consumption.

Recommendations Upgrade to version 1.8.0 to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-643

Identificadores relacionados

CVE-2026-24343

Produtos afetados

Apache Hertzbeat

Referências · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-24343 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2021269126258524543 · Publicação no Twitter
• https://t.me/cveNotify/151530 · Publicação no Telegram
• https://twitter.com/oss_security/status/2020918127547035814 · Publicação no Twitter
• https://lists.apache.org/thread/b2k3jqwffrbo2sy6bl4n0f68kp8bfo1n · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2026/02/09/4 · Nota
• https://t.me/pentestingnews/73033 · Publicação no Telegram
• https://t.me/CVEtracker/44301 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-24343 · Aviso do Fabricante
• https://t.me/cveNotify/151576 · Publicação no Telegram
• https://t.me/cveNotify/151726 · Publicação no Telegram