CVE-2026-114442

{
  "etk_id": "ETK-2026-3362",
  "cve_id": "CVE-2026-114442",
  "display_id": "CVE-2026-114442",
  "ghsa_id": "GHSA-m542-3mx3-33v9",
  "euvd_id": "EUVD-2026-115743",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Incomplete XPath validation in Apache HertzBeat",
  "summary": "Apache HertzBeat versions 1.7.1 through 1.9.0 inadequately validate XPath expressions used by the HTTP collector. An authenticated user permitted to create monitor templates can cause excessive CPU consumption during XML processing, reducing collector availability.",
  "mitigation": "Upgrade Apache HertzBeat to version 1.9.1 or later. Restrict monitor-template creation permissions to trusted users until all instances are updated.",
  "vendor": "Apache Software Foundation",
  "product": "Apache HertzBeat",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "1.7.1",
        "1.7.2",
        "1.7.3",
        "1.8.0",
        "1.9.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Apache HertzBeat",
      "purl": null
    }
  ],
  "cwes": [
    643
  ],
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 36.20868265,
  "t0_at": "2026-11-03T10:21:06.018000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-03T10:21:06.018000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T10:21:06.018000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114442"
    }
  }
}