The vulnerability is an XPath injection flaw that allows an attacker to submit crafted XPath expressions to Apache HertzBeat. The untrusted input is not properly neutralized, which can lead to uncontrolled consumption of system resources. An attacker could trigger excessive CPU or memory usage, potentially resulting in a denial‑of‑service condition for the application or its users.

Apache HertzBeat by the Apache Software Foundation is affected. All releases starting at 1.7.1 up through, but excluding, 1.8.0 are vulnerable. Applications running those versions are susceptible to the exploit.

The CVSS base score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. Apache HertzBeat does not appear in the CISA KEV catalog. The attack requires remote delivery of a malicious XPath expression, likely via exposed API endpoints or web interfaces that accept user input. If exploited, the resource exhaustion can degrade performance or crash the service, interrupting business operations.