Apache Hertzbeat
Monthly
Denial of service in Apache HertzBeat 1.7.1 through 1.9.0 allows authenticated users with monitor-template creation privileges to consume excessive collector CPU by supplying XPath expressions through metrics.aliasFields that bypass the validation applied to parseScript. The flaw is a follow-up to an incomplete fix for CVE-2026-24343 and is fixed in Apache HertzBeat 1.9.1. No public exploit code was identified at time of analysis; the issue has low availability impact under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) and the priority decision is monitor.
Denial of service in Apache HertzBeat 1.7.1 through 1.9.0 allows authenticated users with monitor-template creation privileges to consume excessive collector CPU by supplying XPath expressions through metrics.aliasFields that bypass the validation applied to parseScript. The flaw is a follow-up to an incomplete fix for CVE-2026-24343 and is fixed in Apache HertzBeat 1.9.1. No public exploit code was identified at time of analysis; the issue has low availability impact under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) and the priority decision is monitor.