Apache HertzBeat vulnerabilities

Latest Apache HertzBeat CVEs

Newest publication first

1. CVE-2026-114442 Apache HertzBeat: incomplete XPath expression validation in aliasFields

   Published 2026-11-03

   Medium·CVSS 6.5 EPSS 0.47%

   Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressions through metrics.aliasFields that are...

2. CVE-2026-24343 Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions

   Published 2026-02-10

   High·CVSS 8.8

   Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: from 1.7.1 before 1.8.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.

3. CVE-2024-56736 Apache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config Oss

   Published 2025-04-16

   Medium·CVSS 6.5

   Server-Side Request Forgery (SSRF) vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat (incubating): before 1.7.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue.

4. CVE-2024-41151 Apache HertzBeat: RCE by notice template injection vulnerability

   Published 2024-11-18

   High·CVSS 8.8

   Deserialization of Untrusted Data vulnerability in Apache HertzBeat. This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue.

5. CVE-2024-45791 Apache HertzBeat: Exposure sensitive token via http GET method with query string

   Published 2024-11-18

   High·CVSS 7.5

   Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue.

6. CVE-2024-45505 Apache HertzBeat: Exists Native Deser RCE and file writing vulnerabilities

   Published 2024-11-18

   High·CVSS 8.8

   Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat (incubating): before 1.6.1. Users are recommen...

7. CVE-2024-42323 Apache HertzBeat: RCE by snakeYaml deser load malicious xml

   Published 2024-09-21

   High·CVSS 8.8

   SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat (incubating): before 1.6.0. Users are recommended to upgrade to version 1.6.0, which fixes...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.