PT-2026-7141 · Apache · Apache Hertzbeat

Qingran Zhao · Published 2026-02-09 · Updated 2026-02-11 · CVE-2026-24343

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache HertzBeat versions 1.7.1 through 1.7.9

Description An issue exists in Apache HertzBeat related to improper neutralization of data within XPath expressions, potentially leading to XPath Injection. This could allow for crafted XPath expressions to cause uncontrolled resource consumption.

Recommendations Upgrade to version 1.8.0 to resolve the issue.

Fix

Weakness Enumeration

CWE-643

Related Identifiers

CVE-2026-24343

Affected Products

Apache Hertzbeat

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-24343 · Security Note
• https://lists.apache.org/thread/b2k3jqwffrbo2sy6bl4n0f68kp8bfo1n · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24343 · Vendor Advisory
• https://twitter.com/TheHackerWire/status/2021269126258524543 · Twitter Post
• https://t.me/cveNotify/151530 · Telegram Post
• https://twitter.com/oss_security/status/2020918127547035814 · Twitter Post
• http://openwall.com/lists/oss-security/2026/02/09/4 · Note
• https://t.me/pentestingnews/73033 · Telegram Post
• https://t.me/CVEtracker/44301 · Telegram Post
• https://t.me/cveNotify/151576 · Telegram Post
• https://t.me/cveNotify/151726 · Telegram Post