ROOT-APP-MAVEN-CVE-2026-45367 CVE-2026-45367 in ca.uhn.hapi.fhir:org.hl7.fhir.validation - Patched by Root

Root has patched CVE-2026-45367 in the ca.uhn.hapi.fhir:org.hl7.fhir.validation package for Root:Maven. Multiple fixed versions available...

CVE-2026-45367 HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches, matchesFull, and replaceMatches to Java regex operations without effective timeouts,...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (>=5.6.5, <=6.8.0), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=4.0.3, <=8.10.0) +252 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (>=0.0.1, <=6.9.5)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may MAVEN version =0.0.1, =5.6.5, =4.0.3, =5.6.5, =4.1.0, =4.0.3, =4.1.0, =4.0.3, =4.0.0, =5.0.0, =4.0.3, =5.3.0, =6.2.0, =5.1.0, =6.8.0, =6.4.0, =8.10.0 and more Source cves: CVE-2026-45367 Source advisory: MEND:CVE-2026-45367...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=4.0.0, <=8.10.0), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=5.6.5, <=7.4.5) +223 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (>=1.0.0, <=6.9.4.1)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version =1.0.0, =4.0.0, =5.6.5, =4.1.0, =4.1.0, =4.0.0, =5.0.0, =4.0.0, =5.3.0, =6.2.0, =5.1.0, =6.8.0, =6.4.0, =5.3.0, =4.0.0, =4.0.0, =8.10.0 and more Source cves: CVE-2026-45367 Source advisory: MEND:CVE-2026-45367...

CVE-2026-45367

creationtimestamp| type| source ---|---|--- 2026-07-08 23:00:13+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mq67w72ugf2l...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (6.8.0), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.6.0, <=8.10.0) +186 more potentially affected by CVE-2026-45367 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (>=6.0.0, <=6.9.9)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version =6.0.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.8.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.10.0 and more Source cves: CVE-2026-45367, CVE-2026-55470 Source advisory: GHSA-FXJ4-P9XP-37V5...

HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

The fix for CVE-2026-45367 added RegexTimeout protection to the matches function in DSTU2016MAY, DSTU3, R4, R4B, and R5, but the DSTU2 module was incompletely patched. In org.hl7.fhir.dstu2, replaceMatches was updated while matches at line 2462 still calls the raw String.matchessw without any...

HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

The fix for CVE-2026-45367 added RegexTimeout protection to the matches function in DSTU2016MAY, DSTU3, R4, R4B, and R5, but the DSTU2 module was incompletely patched. In org.hl7.fhir.dstu2, replaceMatches was updated while matches at line 2462 still calls the raw String.matchessw without any...

HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

The fix for CVE-2026-45367 added RegexTimeout protection to the matches function in DSTU2016MAY, DSTU3, R4, R4B, and R5, but the DSTU2 module was incompletely patched. In org.hl7.fhir.dstu2, replaceMatches was updated while matches at line 2462 still calls the raw String.matchessw without any...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (4.0.3), ca.uhn.hapi.fhir:hapi-fhir-converter (4.0.3) +15 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (4.0.3)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 4.0.3 - ca.uhn.hapi.fhir:hapi-fhir-converter 4.0.3 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.10), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.0.10) +3 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.0.10)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.0.10 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.12), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.0.12) +3 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.0.12)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.0.12 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.0.12 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.16), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.0.16) +3 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.0.16)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.0.16 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.0.16 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.1.3), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.1.3) +3 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.1.3)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.1.3 - ca.uhn.hapi.fhir:org.hl7.fhir.validation 5.1.3...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.1.11), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.1.11) +3 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.1.11)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.1.11 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.1.13), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.1.13) +3 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.1.13)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.1.13 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.1.17), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.1.17) +3 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.1.17)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.1.17 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.1.17 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.3.9), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.3.9) potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.3.9)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.3.9 - ca.uhn.hapi.fhir:org.hl7.fhir.validation 5.3.9...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.5.3), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.5.3) potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.5.3)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.5.3 - ca.uhn.hapi.fhir:org.hl7.fhir.validation 5.5.3...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.13), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.13) potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.6.13)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.6.13 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.13 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...