ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.105), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.105) +3 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (5.6.105)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may MAVEN version 5.6.105 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.105 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.108), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.108) potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (5.6.108)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may MAVEN version 5.6.108 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.108 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=4.0.0, <=4.0.1), ca.uhn.hapi.fhir:hapi-fhir-igpacks (>=4.0.0, <=4.0.1) +9 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (4.0.0)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.1.12), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.1.12) +3 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.1.12)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.1.12 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.1.12 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.4.2), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.4.2) potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.4.2)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.4.2 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.4.6), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.4.6) potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.4.6)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.4.6 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.5.6), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.5.6) potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.5.6)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.5.6 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.1.18), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.1.18) potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.1.18)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.1.18 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.1.18 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.2.20), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.2.20) potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.2.20)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.2.20 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.2.20 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (4.1.0), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (4.1.0) +70 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (4.1.0)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 4.1.0 - ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver 4.1.0 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.85), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.85) +3 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4b (5.6.85)

ca.uhn.hapi.fhir:org.hl7.fhir.r4b MAVEN version 5.6.85 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4b and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.85 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (>=6.4.2, <=6.4.7), ca.uhn.hapi.fhir:hapi-fhir-base-test-mindeps-client (>=6.4.2, <=6.4.7) +81 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.6.971)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.6.971 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin =6.4.2, =6.4.2, =6.4.2, =6.4.2,...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.20), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.0.20) potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.0.20)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.0.20 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.13), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.13) potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.13)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.13 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.13 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.79), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.79) +3 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.79)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.79 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.79 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.116), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.116) +4 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.116)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.116 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.116 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=4.0.0, <=4.0.1), ca.uhn.hapi.fhir:hapi-fhir-igpacks (>=4.0.0, <=4.0.1) +6 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (4.0.0)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0,...

HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The FHIRPath functions matches, matchesFull, and replaceMatches pass user-controlled regular expressions directly to Java's Pattern.compile and String.replaceAll without...

HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The FHIRPath functions matches, matchesFull, and replaceMatches pass user-controlled regular expressions directly to Java's Pattern.compile and String.replaceAll without...

WS-2020-0113

Apollo-server-hapi before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable name...