Threats affecting pkg:github/apache/hertzbeat

Apache HertzBeat versions 1.7.1 through 1.9.0 contain an XPath injection vulnerability due to incomplete validation of XPath expressions in the HTTP collector XML parsing path. Authenticated users with permission to create monitor templates can supply crafted XPath expressions that are evaluated without proper validation, potentially causing excessive CPU consumption and impairing collector availability. This issue is a follow-up to a previous incomplete fix (CVE-2026-24343). The vulnerability is fixed in version 1.9.1, and users are advised to upgrade.