CVE-2026-40942: Always-Incorrect Control Flow Implementation

The Data Sharing Framework DSF implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison isBefore instead of isAfter, causing the cache to never return cached values. Every...

CVE-2026-33180

HAPI FHIR (Java) prior to 6.9.0 is affected: when the internal HTTP client follows redirects (HTTP 3xx), it may resend the same request headers to the host in the Location header as well as the initial URL. This exposes privacy-sensitive headers (e.g., authentication tokens) to unintended third-p...

HAPI FHIR HTTP authentication leak in redirects

When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers ...