Apache HertzBeat EUVD-2026-115743

Requires an authenticated account that holds permission to create monitor templates in Apache HertzBeat; the attacker configures an HTTP collector monitor that supplies XPath expressions via metrics.aliasFields (the path where parseScript validation is not applied). Triggering also requires the monitored HTTP endpoint to return a crafted XML response whose repeated XPath evaluation is expensive. Limiting factors: exploitation is not possible for anonymous or low-privilege users, so it is gated by both authentication and the template-creation privilege; it affects only versions 1.7.1 through 1.9.0 and is not exploitable against default configurations by unauthenticated remote attackers.

This is a moderate, authenticated availability (denial-of-service) issue, not a high-priority emergency, and the decision signals agree with that read. The vuln.today Decision label is 'monitor' (not act_now/emergency). No CVSS score or vector was supplied in the input, no EPSS probability is provided, the issue is NOT in CISA KEV, and no public exploit or PoC reference is present - so there is no evidence of active exploitation or weaponization. The flaw requires an authenticated user who already holds permission to create monitor templates, which substantially narrows the attacker population to insiders or compromised privileged accounts, and the technical impact is CPU exhaustion that impairs collector availability - not confidentiality or integrity, despite the input Tag 'Information Disclosure' which is incorrect for this flaw (CWE-643 XPath, availability impact). It is a follow-up to an incomplete fix for CVE-2026-24343, which indicates a recurring validation gap but not a change in severity. Because no official CVSS vector is provided, authentication requirements are stated here from the description only in general terms; the independent assessment below infers PR:L. Net: real but low-urgency; prioritize patching behind actively-exploited issues.

An authenticated user (or attacker using stolen credentials) who holds the privilege to create monitor templates defines an HTTP collector monitor whose metrics.aliasFields contain a costly XPath expression that bypasses the parseScript validation. When the collector processes a crafted XML HTTP response, repeated evaluation of that expression consumes excessive CPU and degrades collector availability. No public exploit code or PoC reference was identified at time of analysis.