CVE-2024-41151

Published: Nov 18, 2024Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Deserialization of Untrusted Data vulnerability in Apache HertzBeat. This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue.

Affected (1)

Products: Apache: Hertzbeat

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Hertzbeat	Before 1.6.1

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (3)

https://lists.apache.org/thread/oor9nw6nh2ojnfw8d8oxrv40cbtk5mwj

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread/p33tg0vo5nh6kscth4262ktsqo3h5lqo

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2024/11/16/6

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.