hapifhir__org_hl7_fhir_core_CVE-2023-28465_5-6-1055

HAPI FHIR - HL7 FHIR Core Artifacts CI Status master --- !Build StatusBadge-BuildPipelineLink-AzureMasterPipeline This is the java core object handling code, with utilities including validator, for the FHIR specification. included in this repo: org.fhir.fhir.utilities: Shared code used by all the...

CVE-2026-115728

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign,...

CVE-2026-115728 @hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign,...

CVE-2026-115728

The @hapi/content library (versions 6.0.1 before 6.0.3 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) via the Content.disposition() function. The root cause is an incomplete fix for CVE-2026-35213, where unauthenticated remote attackers can send multipart uploads featuring a lo...

EUVD-2026-108939

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign,...

CVE-2026-115728 @hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign,...

CVE-2026-113876

SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents...

CVE-2026-113875

On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access...

CVE-2026-113873

SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed...

CVE-2026-113874

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition...

CVE-2026-113876 SmileCDR HAPI FHIR unauthorized read

SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents...

EUVD-2026-108276

SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents...

CVE-2026-113876 SmileCDR HAPI FHIR unauthorized read

SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents...

CVE-2026-113876

The SmileCDR HAPI FHIR application contains an incorrect authorization vulnerability (CWE-863) regarding conditional create actions . An attacker possessing CREATE permissions but lacking READ permissions can submit a conditional create request where the predicate matches an existing resource. If...

EUVD-2026-108275

On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access...

CVE-2026-113875

The SmileCDR HAPI FHIR server is vulnerable to an unauthorized read vulnerability when REST-hook subscriptions are enabled. If a user possesses subscription-creation permissions , they can exploit this flaw to query and access resources for which they do not have the necessary permissions. The ro...

CVE-2026-113875 SmileCDR HAPI FHIR unauthorized read via subscription

On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access...

CVE-2026-113874

The SmileCDR HAPI FHIR component is vulnerable to a partition identity override because it allows an untrusted bundle body to replace a partition identity previously established by a trusted source. Due to a lack of default storage partition entitlement enforcement, an attacker authorized for one...

CVE-2026-113874 SmileCDR HAPI FHIR trusted tenant partition override

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition...

EUVD-2026-108274

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition...