ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +6 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.0.release)

org.springframework:spring-websocket MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.5), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.5) +10 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.2.5.release)

org.springframework:spring-websocket MAVEN version 4.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.5 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=7.0.0, <=8.4.3), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=7.0.0, <=7.4.5) +130 more potentially affected by CVE-2025-59250 via com.microsoft.sqlserver:mssql-jdbc (>=12.3.1.jre8-preview, <=12.4.2.jre11)

com.microsoft.sqlserver:mssql-jdbc MAVEN version =12.3.1.jre8-preview, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =1.0.0-beta1, =1.0.0-beta1, =1.0.0-beta1, =1.6.10, =2.3.1, =2.3.1, =2.3.1, =2.3.1, =2.3.2 and more Source cves: CVE-2025-59250 Source advisory: SNYK:JAVA-COMMICROSOFTSQLSERVER-13821835...

EUVD-2020-17036

Malware in sbrugna...

EUVD-2021-1274

Malware in sbrugna...

EUVD-2019-0503

Malware in sbrugna...

EUVD-2023-0498

Malicious code in bioql PyPI...

EUVD-2024-3256

Malicious code in bioql PyPI...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=3.8.0, <=4.2.0), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=4.1.0, <=4.2.0) +567 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.4.2.final)

org.hibernate:hibernate-validator MAVEN version 5.4.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =3.8.0, =4.1.0, =3.8.0, =3.8.0, =3.8.0, =4.0.0,...

CVE-2021-32053

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +168 more potentially affected by CVE-2025-22233 via org.springframework:spring-context (4.3.0.release)

org.springframework:spring-context MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (3.0.0), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (3.0.0) +1607 more potentially affected by CVE-2025-22233 via org.springframework:spring-context (4.3.10.release)

org.springframework:spring-context MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 3.0.0 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.0.0, <=6.10.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.0.3, <=6.10.5) +275 more potentially affected by CVE-2024-52981 via org.elasticsearch:elasticsearch (>=7.17.0, <=7.17.23)

org.elasticsearch:elasticsearch MAVEN version =7.17.0, =6.0.0, =6.0.3, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.0, =6.8.0, =6.4.0, =6.0.0, =6.0.0, =6.0.3, =6.8.0, =1.0, =1.0.0, =6.0.01 and more Source cves: CVE-2024-52981 Source advisory: GHSA-5XM9-X7X4-4J5X...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.0.0, <=6.10.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.0.3, <=6.10.5) +251 more potentially affected by CVE-2024-52981 via org.elasticsearch:elasticsearch-geo (>=7.17.0, <=7.17.23)

org.elasticsearch:elasticsearch-geo MAVEN version =7.17.0, =6.0.0, =6.0.3, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.0, =6.8.0, =6.4.0, =6.0.0, =6.0.0, =6.0.3, =6.8.0, =1.0, =1.0.0, =6.0.01 and more Source cves: CVE-2024-52981 Source advisory: MEND:CVE-2024-52981...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.0.0, <=6.10.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.0.3, <=6.10.5) +275 more potentially affected by CVE-2024-52981 via org.elasticsearch:elasticsearch (>=7.17.0, <=7.17.23)

org.elasticsearch:elasticsearch MAVEN version =7.17.0, =6.0.0, =6.0.3, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.0, =6.8.0, =6.4.0, =6.0.0, =6.0.0, =6.0.3, =6.8.0, =1.0, =1.0.0, =6.0.01 and more Source cves: CVE-2024-52981 Source advisory: MEND:CVE-2024-52981...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.1.0, <=5.2.1), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=5.1.0, <=5.2.1) +59 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (6.5.4)

org.elasticsearch:elasticsearch MAVEN version 6.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +26 more potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (4.3.0.release)

org.springframework:spring-webmvc MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

XML External Entity (XXE) Injection

HAPI FHIR is vulnerable to XML External Entity XXE Injection. The vulnerability is due to insecure XML parsing by HAPI FHIR, specifically within the XSLT parsing components, which improperly handle external entity references in XML files. It allows attackers to inject malicious XML content, such ...

org.hl7.fhir.convertors: org.hl7.fhir.dstu2: org.hl7.fhir.dstu2016may: org.hl7.fhir.dstu3: org.hl7.fhir.r4: org.hl7.fhir.r5: org.hl7.fhir.utilities: org.hl7.fhir.validation: org.hl7.fhir.core: FHIR arbitrary code execution via specially-crafted request

A flaw was found in Fast Healthcare Interoperability Resources HAPI FHIR. This vulnerability could allow attackers to execute arbitrary code or access sensitive information via a crafted request which contains malicious XML entities...

XML External Entity (XXE)

hapi fhir is vulnerable to XML External Entity XXE. The vulnerability is due to improper handling of XML input. Specifically, the system fails to properly disable or validate external entities within XML documents, allowing attackers to inject malicious XML that can lead to unauthorized data acce...