CVE-2026-24343

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-24343
Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: from 1.7.1 before 1.8.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/b2k3jqwffrbo2sy6bl4n0f68kp8bfo1n Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/02/09/4 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:hertzbeat:*:*:*:*:*:*:*:*
History

17 Jun 2026, 10:22

Type Values Removed Values Added
Summary
  • (es) Neutralización Incorrecta de Datos dentro de Expresiones XPath ('Inyección XPath') vulnerabilidad en Apache HertzBeat. Este problema afecta a Apache HertzBeat: desde 1.7.1 anterior a 1.8.0. Se recomienda a los usuarios actualizar a la versión 1.8.0, que corrige el problema.

11 Feb 2026, 17:56

Type Values Removed Values Added
First Time Apache hertzbeat
Apache
References () https://lists.apache.org/thread/b2k3jqwffrbo2sy6bl4n0f68kp8bfo1n - () https://lists.apache.org/thread/b2k3jqwffrbo2sy6bl4n0f68kp8bfo1n - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2026/02/09/4 - () http://www.openwall.com/lists/oss-security/2026/02/09/4 - Mailing List, Third Party Advisory
CPE cpe:2.3:a:apache:hertzbeat:*:*:*:*:*:*:*:*

10 Feb 2026, 16:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8

10 Feb 2026, 11:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/02/09/4 -

10 Feb 2026, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-10 10:15

Updated : 2026-06-17 10:22

NVD link : CVE-2026-24343

Mitre link : CVE-2026-24343

CVE.ORG link : CVE-2026-24343

JSON object : View

Products Affected

apache

  • hertzbeat
CWE
CWE-643

Improper Neutralization of Data within XPath Expressions ('XPath Injection')