PT-2026-7141 · Apache · Apache Hertzbeat

Qingran Zhao · CVE-2026-24343 · Published 2026-02-09 · Updated 2026-02-11

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache HertzBeat versions 1.7.1 through 1.7.9

Description An issue exists in Apache HertzBeat related to improper neutralization of data within XPath expressions, potentially leading to XPath Injection. This could allow for crafted XPath expressions to cause uncontrolled resource consumption.

Recommendations Upgrade to version 1.8.0 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-643

Related Identifiers

CVE-2026-24343

Affected Products

Apache Hertzbeat

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24343.json · Exploit
• https://lists.apache.org/thread/b2k3jqwffrbo2sy6bl4n0f68kp8bfo1n · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24343 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24343 · Security Note
• https://twitter.com/TheHackerWire/status/2021269126258524543 · Twitter Post
• https://t.me/cveNotify/151576 · Telegram Post
• https://t.me/cveNotify/151530 · Telegram Post
• https://t.me/pentestingnews/73033 · Telegram Post
• http://openwall.com/lists/oss-security/2026/02/09/4 · Note
• https://twitter.com/oss_security/status/2020918127547035814 · Twitter Post
• https://t.me/cveNotify/151726 · Telegram Post
• https://t.me/CVEtracker/44301 · Telegram Post