CVE-2026-62295

HAPI FHIR (Java) prior to 6.9.11 has a denial-of-service risk: the JSON parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth, so deeply nested, valid FHIR JSON can trigger unbounded readArray/readObject recursion and cause a StackOverflowError before validatio...

CVE-2026-62295 HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested,...

CVE-2026-62293 HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As...

CVE-2026-62293 HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As...

CVE-2026-62293

CVE-2026-62293 affects HAPI FHIR (Java) prior to 6.9.11. The vulnerability arises when the hidden scan command concatenates attacker‑controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java, enabling stored XSS in the generated ...

CVE-2026-67610

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an...

CVE-2026-67610

OpenEMR 8.2.0 is affected by an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint. Attackers can unauthenticatedly register a malicious client by supplying a self-generated RSA keypair in the jwks field, leveraging system-level FHIR scopes. After an administ...

CVE-2026-67610 OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an...

EUVD-2026-52347

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an...

CVE-2026-67610 OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an...

CVE-2026-16481

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...

CVE-2026-16481

A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability affects the cloud-healthcare-fhir-fetch-page tool in googleapis/mcp-toolbox . The tool accepts an unvalidated pageURL parameter and issues an HTTP GET request via an authenticated client whose transport automatically a...

EUVD-2026-49407

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...

CVE-2026-16481 Server-Side Request Forgery (SSRF) and Credential Exfiltration in googleapis/mcp-toolbox cloud-healthcare-fhir-fetch-page Tool

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...

CVE-2026-55471

A flaw was found in the HAPI FHIR XsltUtilities component. The saxonTransform functions within this utility do not adequately restrict external entity access when processing XML. This oversight allows an attacker, who can control or tamper with the XML data being transformed, to inject malicious...

CVE-2026-55470

A flaw was found in HAPI FHIR, a Java implementation of the HL7 FHIR standard. The fix for a previous vulnerability CVE-2026-45367 was incomplete in the DSTU2 module. Specifically, the FHIRPathEngine.matches function in org.hl7.fhir.dstu2 did not include protection against regular expression...

CVE-2026-49485

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches,...

CVE-2026-49485

Summary: CVE-2026-49485 affects HAPI FHIR’s FHIRPathEngine (matches(), matchesFull(), replaceMatches()) where user-controlled regex patterns are compiled via Java’s regex engine, enabling ReDoS and CPU exhaustion. The issue exists in implementations prior to version 6.9.9 and 6.9.4.2. An attacker...

CVE-2026-49485 HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches,...

CVE-2026-49485 HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches,...