ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.4.0, <=5.4.2), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=5.4.0, <=5.4.2) +67 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.4.0)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.3.14), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.3.14) potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.3.14)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.3.14 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.3.14 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.3.10), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.3.10) potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.3.10)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.3.10 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.20), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.0.20) potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.0.20)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.0.20 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.0.0, <=5.0.2), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=5.0.0, <=5.0.2) +56 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.0.0)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (1.1.67), ca.uhn.hapi.fhir:org.hl7.fhir.validation (1.1.67) potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (1.1.67)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 1.1.67 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 1.1.67 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.114), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.114) +3 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.6.114)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.6.114 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.114 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.107), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.107) potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.6.107)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.6.107 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.107 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.16), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.0.16) +3 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.0.16)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.0.16 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.0.16 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.9), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.0.9) potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.0.9)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.0.9 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.115), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.115) +3 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.6.115)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.6.115 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.115 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (6.8.0), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.6.0, <=8.10.0) +188 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (>=6.0.0, <=6.9.4.1)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version =6.0.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.8.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.10.0 and more Source cves: CVE-2026-49485 Source advisory: GHSA-7CMJ-V6X8-FRVV...

CVE-2026-55470

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matchessw...

CVE-2026-55471

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform... overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl without ACCESSEXTERNALDTD or ACCESSEXTERNALSTYLESHEET...

EUVD-2026-42441

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform... overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl without ACCESSEXTERNALDTD or ACCESSEXTERNALSTYLESHEET...

CVE-2026-55471

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform... overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl without ACCESSEXTERNALDTD or ACCESSEXTERNALSTYLESHEET...

CVE-2026-55471

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform... overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl without ACCESSEXTERNALDTD or ACCESSEXTERNALSTYLESHEET...

CVE-2026-55471 HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform... overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl without ACCESSEXTERNALDTD or ACCESSEXTERNALSTYLESHEET...

CVE-2026-55471 HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform... overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl without ACCESSEXTERNALDTD or ACCESSEXTERNALSTYLESHEET...

CVE-2026-55471

CVE-2026-55471 affects HAPI FHIR: org.hl7.fhir.utilities XsltUtilities.saxsonTransform overloads (XsltUtilities.saxonTransform) prior to 6.9.10. The root cause is the use of a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET restrictions, enabl...