ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.70), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.70) +3 more potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.70)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.70 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.70 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (0.0.1), ca.uhn.hapi.fhir:org.hl7.fhir.validation (0.0.1) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (0.0.1)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 0.0.1 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.5.8), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.5.8) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.5.8)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.5.8 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.6.0, <=8.10.0), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.6.0, <=7.4.5) +170 more potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.convertors (>=6.0.0, <=6.9.9)

ca.uhn.hapi.fhir:org.hl7.fhir.convertors MAVEN version =6.0.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.8.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.4.0, =6.8.0, =8.10.0 and more Source cves: CVE-2026-55470 Source advisory: OSV:GHSA-FXJ4-P9XP-37V5...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.6.0, <=5.6.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (5.6.5) +27 more potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.5.7)

ca.uhn.hapi.fhir:org.hl7.fhir.convertors MAVEN version 5.5.7 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.convertors and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =5.6.0, =5.6.0, =5.6.0, =5.6.0, =5.6.0,...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.51), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.51) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.51)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.51 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.51 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.4.3), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.4.3) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.4.3)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.4.3 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.0.7) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.7)

ca.uhn.hapi.fhir:org.hl7.fhir.convertors MAVEN version 5.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.convertors and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.validation 5.0.7 Source cves: CVE-2026-55470 Sour...

GHSA-FXJ4-P9XP-37V5 HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

Summary The fix for CVE-2026-45367 added RegexTimeout protection to the matches function in DSTU2016MAY, DSTU3, R4, R4B, and R5, but the DSTU2 module was incompletely patched. In org.hl7.fhir.dstu2, replaceMatches was updated while matches at line 2462 still calls the raw String.matchessw without...

HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

The fix for CVE-2026-45367 added RegexTimeout protection to the matches function in DSTU2016MAY, DSTU3, R4, R4B, and R5, but the DSTU2 module was incompletely patched. In org.hl7.fhir.dstu2, replaceMatches was updated while matches at line 2462 still calls the raw String.matchessw without any...

HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

The fix for CVE-2026-45367 added RegexTimeout protection to the matches function in DSTU2016MAY, DSTU3, R4, R4B, and R5, but the DSTU2 module was incompletely patched. In org.hl7.fhir.dstu2, replaceMatches was updated while matches at line 2462 still calls the raw String.matchessw without any...

HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

org.hl7.fhir.utilities.XsltUtilities exposes two parallel families of XSLT transform helpers. The transform... overloads obtain their TransformerFactory from the project's hardened helper XMLUtil.newXXEProtectedTransformerFactory which sets ACCESSEXTERNALDTD="" and ACCESSEXTERNALSTYLESHEET="". Th...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.0.0, <=3.4.0) +391 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.13.6.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 3.4.0 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.0.0, <=3.4.0) +1617 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.3.10.release)

org.springframework:spring-expression MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 3.4.0 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +166 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.3.0.release)

org.springframework:spring-expression MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=2.0, <=2.2) +348 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.3.1.release)

org.springframework:spring-expression MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =2.0, =2.0, =2.1.0-release,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.0.0, <=3.4.0) +1617 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.3.10.release)

org.springframework:spring-expression MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 3.4.0 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +166 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.3.0.release)

org.springframework:spring-expression MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (3.0.0), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (3.0.0) +636 more potentially affected by CVE-2026-41846 via org.springframework:spring-webmvc (4.3.10.release)

org.springframework:spring-webmvc MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 3.0.0 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (3.0.0), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (3.0.0) +636 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.3.10.release)

org.springframework:spring-webmvc MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 3.0.0 -...