CVE-2026-49485

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches,...

au.csiro.pathling:encoders (>=9.6.0, <=9.7.1), au.csiro.pathling:fhirpath (>=9.6.0, <=9.7.1) +9 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (>=6.9.5, <=6.9.8)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version =6.9.5, =9.6.0, =9.6.0, =9.6.0, =9.6.0, =9.6.0, =6.9.5, =6.9.5, =4.1.8, =2.2.7, =2.2.7, =2.2.7, =2.2.8 Source cves: CVE-2026-49485 Source advisory: MEND:CVE-2026-49485...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (>=6.4.2, <=6.4.7), ca.uhn.hapi.fhir:hapi-fhir-base-test-mindeps-client (>=6.4.2, <=6.4.7) +81 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.6.971)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.6.971 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin =6.4.2, =6.4.2, =6.4.2, =6.4.2,...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.117), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.117) +3 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (5.6.117)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 5.6.117 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.117 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.110), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.110) +3 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.6.110)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.6.110 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.110 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.1.15), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.1.15) +3 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.1.15)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.1.15 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.1.15 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

org.hl7.fhir.publisher:org.hl7.fhir.publisher (1.2.54), org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli (1.2.54) +1 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.113)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.6.113 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - org.hl7.fhir.publisher:org.hl7.fhir.publisher 1.2.54 -...

org.hl7.fhir.publisher:org.hl7.fhir.publisher (>=1.3.0, <=1.3.1), org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli (>=1.3.0, <=1.3.1) +1 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.114)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.6.114 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - org.hl7.fhir.publisher:org.hl7.fhir.publisher =1.3.0, =1.3.0, =1.3.0, =1.3.1...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.107), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.107) potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r4b (5.6.107)

ca.uhn.hapi.fhir:org.hl7.fhir.r4b MAVEN version 5.6.107 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4b and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.107 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.72), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.72) +3 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r4b (5.6.72)

ca.uhn.hapi.fhir:org.hl7.fhir.r4b MAVEN version 5.6.72 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4b and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.72 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.92), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.92) +3 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r4b (5.6.92)

ca.uhn.hapi.fhir:org.hl7.fhir.r4b MAVEN version 5.6.92 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4b and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.92 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.113), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.113) +3 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.113)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.113 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.113 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.99), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.99) +3 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.99)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.99 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.99 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (6.9.5), ca.uhn.hapi.fhir:org.hl7.fhir.validation (6.9.5) potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (6.9.5)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 6.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 6.9.5 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.74), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.74) +3 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.74)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.74 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.74 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.47), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.47) potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.47)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.47 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.47 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.50), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.50) +3 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.50)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.50 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.50 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.61), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.61) +3 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.61)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.61 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.61 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.46), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.46) potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.46)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.46 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.46 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.5.0, <=5.5.7), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=5.5.0, <=5.5.7) +56 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.4.10)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.4.10 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =5.5.0, =5.5.0, =5.5.0, =5.5.0, =5.5.0, =5.5.0, =5.5....