Apache HertzBeat versions 1.7.1 through 1.9.0 contain incomplete XPath expression validation in the HTTP collector XML parsing path. Authenticated users with permission to create monitor templates can supply XPath expressions that are evaluated without proper validation, potentially causing excessive CPU consumption and impairing collector availability. This issue is a follow-up to a previous incomplete fix (CVE-2026-24343). The vulnerability is fixed in version 1.9.1.