ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.2.0, <=5.2.1), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=5.2.0, <=5.2.1) +38 more potentially affected by CVE-2026-81875 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.2.0)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =5.2.0, =5.2.0, =5.2.0, =5.2.0, =5.2.0,...

CVE-2026-40939: Insufficient Session Expiration

The Data Sharing Framework DSF implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired. This...