CVE-2024-42323

8.8 highEPSS 8.3%

High (8.8) in apache hertzbeat. EPSS 8.3% chance of exploitation in the next 30 days.

SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat (incubating): before 1.6.0. Users are recommended to upgrade to version 1.6.0, which fixes the issue.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 8.3% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2024-09-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:hertzbeat

References

https://lists.apache.org/thread/dwpwm572sbwon1mknlwhkpbom2y7skbx
https://lists.apache.org/thread/r0c4tost4bllqc1n9q6rmzs1slgsq63t
http://www.openwall.com/lists/oss-security/2024/09/21/1

Check your stack JSON