{"id":"CVE-2026-24343","summary":"Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions","details":"Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat.\n\nThis issue affects Apache HertzBeat: from 1.7.1 before 1.8.0.\n\nUsers are recommended to upgrade to version 1.8.0, which fixes the issue.","modified":"2026-08-12T15:32:53.144882Z","published":"2026-02-10T09:28:52.465Z","database_specific":{"cna_assigner":"apache","cwe_ids":["CWE-643"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24343.json","unresolved_ranges":[{"extracted_events":[{"introduced":"1.7.1"},{"fixed":"1.8.0"}],"source":"AFFECTED_FIELD"},{"extracted_events":[{"introduced":"1.7.1"},{"fixed":"1.8.0"}],"source":"DESCRIPTION"}]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/02/09/4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24343.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/b2k3jqwffrbo2sy6bl4n0f68kp8bfo1n"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24343"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/hertzbeat","events":[{"introduced":"d2b030dd94f246b3668613ef8190c30606df4ce2"},{"fixed":"1b51c19c972cdccd2970b71e72ed73dad8ff92a9"}],"database_specific":{"extracted_events":[{"introduced":"1.7.1"},{"fixed":"1.8.0"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:apache:hertzbeat:*:*:*:*:*:*:*:*"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24343.json","vanir_signatures_modified":"2026-08-12T15:32:53Z","vanir_signatures":[{"source":"https://github.com/apache/hertzbeat/commit/1b51c19c972cdccd2970b71e72ed73dad8ff92a9","target":{"file":"hertzbeat-warehouse/src/test/java/org/apache/hertzbeat/warehouse/store/TdEngineDataStorageTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["53033068047436181540837752067815066611","71938792451142702145780666807312638732","185237302934097350434418980537312470593","132293447870326662302586476361287186902","263512250518369006794070536173091430207","190975345119162932468646221998072473101","51368052323825541481366893320913296991","242712943421769586161584198055422995621","19994673265612285444568720559781413861","53567060342046444506021687660955953445","301250845242938807046247725622614626351","128998801841687832448039993823390411723","110983094963052489690594062295937783967"]},"id":"CVE-2026-24343-26c13c8b","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["101985091812589877102980538395908193294","272880958665566622074280762418449246520","151659756674204260201603310838768904497","242650969418994622628002708557984209507","41378585723454860520946512130734319821","81949062089191391749779947034022018496","195616442931820536833131320153571191253","27994158369907679642417433864863517969","18785047884902338447870974001426250367","58094069660371555128202112808370234746","239495479380770418680145527508154549422","334523339728727407073469933370817279979"],"threshold":0.9},"id":"CVE-2026-24343-4fcf5bac","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/hertzbeat/commit/1b51c19c972cdccd2970b71e72ed73dad8ff92a9","target":{"file":"hertzbeat-warehouse/src/main/java/org/apache/hertzbeat/warehouse/store/history/tsdb/tdengine/TdEngineDataStorage.java"}},{"digest":{"line_hashes":["144633617260848927864810518686580684003","58650337939443767453802022617309508970"],"threshold":0.9},"id":"CVE-2026-24343-6f1de650","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/hertzbeat/commit/1b51c19c972cdccd2970b71e72ed73dad8ff92a9","target":{"file":"hertzbeat-common/src/main/java/org/apache/hertzbeat/common/util/StrBuffer.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"110003769105996664021943126932212910874","length":4033},"id":"CVE-2026-24343-9f42c42f","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/hertzbeat/commit/1b51c19c972cdccd2970b71e72ed73dad8ff92a9","target":{"file":"hertzbeat-warehouse/src/main/java/org/apache/hertzbeat/warehouse/store/history/tsdb/tdengine/TdEngineDataStorage.java","function":"saveData"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}