hapifhir__org_hl7_fhir_core_CVE-2023-28465_5-6-1055

HAPI FHIR - HL7 FHIR Core Artifacts CI Status master --- !Build StatusBadge-BuildPipelineLink-AzureMasterPipeline This is the java core object handling code, with utilities including validator, for the FHIR specification. included in this repo: org.fhir.fhir.utilities: Shared code used by all the...

ROOT-APP-MAVEN-CVE-2026-55470 CVE-2026-55470 in ca.uhn.hapi.fhir:org.hl7.fhir.validation - Patched by Root

Root has patched CVE-2026-55470 in the ca.uhn.hapi.fhir:org.hl7.fhir.validation package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-34361 CVE-2026-34361 in ca.uhn.hapi.fhir:org.hl7.fhir.validation - Patched by Root

Root has patched CVE-2026-34361 in the ca.uhn.hapi.fhir:org.hl7.fhir.validation package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-33180 CVE-2026-33180 in ca.uhn.hapi.fhir:org.hl7.fhir.utilities - Patched by Root

Root has patched CVE-2026-33180 in the ca.uhn.hapi.fhir:org.hl7.fhir.utilities package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-45367 CVE-2026-45367 in ca.uhn.hapi.fhir:org.hl7.fhir.validation - Patched by Root

Root has patched CVE-2026-45367 in the ca.uhn.hapi.fhir:org.hl7.fhir.validation package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-49485 CVE-2026-49485 in ca.uhn.hapi.fhir:org.hl7.fhir.validation - Patched by Root

Root has patched CVE-2026-49485 in the ca.uhn.hapi.fhir:org.hl7.fhir.validation package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-34359 CVE-2026-34359 in ca.uhn.hapi.fhir:org.hl7.fhir.utilities - Patched by Root

Root has patched CVE-2026-34359 in the ca.uhn.hapi.fhir:org.hl7.fhir.utilities package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-34360 CVE-2026-34360 in ca.uhn.hapi.fhir:org.hl7.fhir.core - Patched by Root

Root has patched CVE-2026-34360 in the ca.uhn.hapi.fhir:org.hl7.fhir.core package for Root:Maven. Multiple fixed versions available...

CVE-2026-62296

A flaw was found in HAPI FHIR, a Java implementation of the HL7 FHIR standard. The XHTML narrative parser does not limit element nesting depth, which allows a deeply nested narrative to trigger unbounded recursion. A remote attacker can exploit this vulnerability by submitting FHIR resources...

CVE-2026-81876

creationtimestamp| type| source ---|---|--- 2026-09-17 22:35:19+00:00| published-proof-of-concept| https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-gq9c-wmrm-5hvr 2026-09-18 10:32:02+00:00| seen| https://gist.github.com/alon710/ccdbb258ac65bfe162fcd19f3dfec9e5...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.5.0, <=5.5.7), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=5.5.0, <=5.5.7) +60 more potentially affected by CVE-2026-81876 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (5.4.10)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 5.4.10 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =5.5.0, =5.5.0, =5.5.0, =5.5.0, =5.5.0, =5.5.0, =5.5.0,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.3.0, <=5.3.3), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=5.3.0, <=5.3.3) +58 more potentially affected by CVE-2026-81876 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (5.3.0)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =5.3.0, =5.3.0, =5.3.0, =5.3.0, =5.3.0, =5.3.0, =5.3.0,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.6.0, <=8.10.0), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.6.0, <=7.4.5) +155 more potentially affected by CVE-2026-81876 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (>=6.0.0, <=6.9.11)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version =6.0.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.8.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.4.0, =6.8.0, =6.6.0, =8.10.0 and more Source cves: CVE-2026-81876 Source advisory: GHSA-GQ9C-WMRM-5HVR...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.104), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.104) potentially affected by CVE-2026-81876 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (5.6.104)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 5.6.104 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.104 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

EUVD-2026-80998

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.6.0, <=8.10.0), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.6.0, <=7.4.5) +188 more potentially affected by CVE-2026-81876 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (>=6.0.0, <=6.9.10)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version =6.0.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.8.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.4.0, =8.12.1 and more Source cves: CVE-2026-81876 Source advisory: SNYK:JAVA-CAUHNHAPIFHIR-19963994...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.4.2, <=6.4.7), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.4.2, <=6.4.7) +58 more potentially affected by CVE-2026-81876 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.971)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.6.971 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =6.4.2, =6.4.2, =6.4.2, =6.4.2, =6.4.2,...

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

Summary A malformed Smart Health Card SHC JWT with zip: "DEF" and an empty or truncated DEFLATE payload causes SHCParser.inflate to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service. Details The...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (6.4.0), ca.uhn.hapi.fhir:hapi-fhir-cli-app (6.4.0) +25 more potentially affected by CVE-2026-81876 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (5.6.881)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 5.6.881 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 6.4.0 - ca.uhn.hapi.fhir:hapi-fhir-cli-app 6.4.0 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=3.4.0, <=6.4.7), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.4.2, <=6.4.7) +72 more potentially affected by CVE-2026-81876 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (5.6.971)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 5.6.971 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =3.4.0, =6.4.2, =6.4.2, =6.4.2, =6.4.2, =6.4.2, =6.4.2,...