ca.uhn.hapi.fhir/org.hl7.fhir.dstu2: ca.uhn.hapi.fhir/org.hl7.fhir.convertors: ca.uhn.hapi.fhir/org.hl7.fhir.validation: ca.uhn.hapi.fhir/org.hl7.fhir.validation.cli: HAPI FHIR: Denial of Service via Regular Expression Backtracking in DSTU2 Module

A flaw was found in HAPI FHIR, a Java implementation of the HL7 FHIR standard. The fix for a previous vulnerability CVE-2026-45367 was incomplete in the DSTU2 module. Specifically, the FHIRPathEngine.matches function in org.hl7.fhir.dstu2 did not include protection against regular expression...

ca.uhn.hapi.fhir/org.hl7.fhir.utilities: HAPI FHIR XsltUtilities: XML External Entity injection allows local file disclosure and SSRF

A flaw was found in the HAPI FHIR XsltUtilities component. The saxonTransform functions within this utility do not adequately restrict external entity access when processing XML. This oversight allows an attacker, who can control or tamper with the XML data being transformed, to inject malicious...

ROOT-APP-MAVEN-CVE-2026-34359 CVE-2026-34359 in ca.uhn.hapi.fhir:org.hl7.fhir.utilities - Patched by Root

Root has patched CVE-2026-34359 in the ca.uhn.hapi.fhir:org.hl7.fhir.utilities package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-55470 CVE-2026-55470 in ca.uhn.hapi.fhir:org.hl7.fhir.validation - Patched by Root

Root has patched CVE-2026-55470 in the ca.uhn.hapi.fhir:org.hl7.fhir.validation package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-33180 CVE-2026-33180 in ca.uhn.hapi.fhir:org.hl7.fhir.utilities - Patched by Root

Root has patched CVE-2026-33180 in the ca.uhn.hapi.fhir:org.hl7.fhir.utilities package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-45367 CVE-2026-45367 in ca.uhn.hapi.fhir:org.hl7.fhir.validation - Patched by Root

Root has patched CVE-2026-45367 in the ca.uhn.hapi.fhir:org.hl7.fhir.validation package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-49485 CVE-2026-49485 in ca.uhn.hapi.fhir:org.hl7.fhir.validation - Patched by Root

Root has patched CVE-2026-49485 in the ca.uhn.hapi.fhir:org.hl7.fhir.validation package for Root:Maven. Multiple fixed versions available...

CVE-2026-62293

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As...

CVE-2026-62296

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner and parseElement, raisi...

CVE-2026-62296 HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner and parseElement, raisi...

CVE-2026-62295

HAPI FHIR (Java) prior to 6.9.11 has a denial-of-service risk: the JSON parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth, so deeply nested, valid FHIR JSON can trigger unbounded readArray/readObject recursion and cause a StackOverflowError before validatio...

CVE-2026-62295 HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested,...

CVE-2026-62293 HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As...

CVE-2026-62293 HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As...

CVE-2026-62293

CVE-2026-62293 affects HAPI FHIR (Java) prior to 6.9.11. The vulnerability arises when the hidden scan command concatenates attacker‑controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java, enabling stored XSS in the generated ...

CVE-2026-55471

A flaw was found in the HAPI FHIR XsltUtilities component. The saxonTransform functions within this utility do not adequately restrict external entity access when processing XML. This oversight allows an attacker, who can control or tamper with the XML data being transformed, to inject malicious...

CVE-2026-55470

A flaw was found in HAPI FHIR, a Java implementation of the HL7 FHIR standard. The fix for a previous vulnerability CVE-2026-45367 was incomplete in the DSTU2 module. Specifically, the FHIRPathEngine.matches function in org.hl7.fhir.dstu2 did not include protection against regular expression...

CVE-2026-49485

Summary: CVE-2026-49485 affects HAPI FHIR’s FHIRPathEngine (matches(), matchesFull(), replaceMatches()) where user-controlled regex patterns are compiled via Java’s regex engine, enabling ReDoS and CPU exhaustion. The issue exists in implementations prior to version 6.9.9 and 6.9.4.2. An attacker...

CVE-2026-49485 HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches,...

CVE-2026-45367

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches, matchesFull, and replaceMatches to Java regex operations without effective timeouts,...