CVE-2026-55471 HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform... overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl without ACCESSEXTERNALDTD or ACCESSEXTERNALSTYLESHEET...

CVE-2026-55470 HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matchessw...

EUVD-2026-42440

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matchessw...

CVE-2026-55470 HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matchessw...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (>=5.6.5, <=6.8.0), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=4.0.0, <=8.10.0) +262 more potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (>=0.0.1, <=6.9.9)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version =0.0.1, =5.6.5, =4.0.0, =5.6.5, =4.1.0, =4.0.3, =4.1.0, =4.0.0, =4.0.0, =5.0.0, =4.0.0, =5.3.0, =6.2.0, =5.1.0, =6.8.0, =6.4.0, =8.10.0 and more Source cves: CVE-2026-55470 Source advisory: MEND:CVE-2026-55470...

CVE-2026-55470 HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matchessw...

CVE-2026-55470

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matchessw...

CVE-2026-55470

CVE-2026-55470 affects the DSTU2 module of HAPI FHIR (org.hl7.fhir.dstu2) where FHIRPathEngine.matches() still uses raw String.matches(sw) with no RegexTimeout, enabling unauthenticated attackers to trigger catastrophic regex backtracking and exhaust CPU. The issue is resolved by upgrading to 6.9...

CVE-2026-55470

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matchessw...

CVE-2026-55470: Inefficient Regular Expression Complexity

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matchessw...

CVE-2026-55471: Improper Restriction of XML External Entity Reference

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform... overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl without ACCESSEXTERNALDTD or ACCESSEXTERNALSTYLESHEET...

ROOT-APP-NPM-CVE-2026-35213 CVE-2026-35213 in @rootio/hapi__content - Patched by Root

Root has patched CVE-2026-35213 in the @rootio/hapicontent package for Root:npm. Multiple fixed versions available...

au.csiro.pathling:encoders (>=6.2.2, <=9.7.1), au.csiro.pathling:fhir-server (>=6.2.2, <=7.2.0) +259 more potentially affected by CVE-2026-55471 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (>=6.0.0, <=6.9.9)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version =6.0.0, =6.2.2, =6.2.2, =6.2.2, =6.2.2, =6.2.2, =6.2.2, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.10.0 and more Source cves: CVE-2026-55471 Source advisory: OSV:GHSA-2F55-G35J-5JMF...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (5.1.0), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (5.1.0) +75 more potentially affected by CVE-2026-55471 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (5.1.0)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 5.1.0 - ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserv...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.113), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.113) +9 more potentially affected by CVE-2026-55471 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (5.6.113)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 5.6.113 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.113 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.58), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.58) +6 more potentially affected by CVE-2026-55471 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (5.6.58)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 5.6.58 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.58 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.59), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.59) +9 more potentially affected by CVE-2026-55471 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (5.6.59)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 5.6.59 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.59 -...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (6.4.1), ca.uhn.hapi.fhir:hapi-fhir-base-test-mindeps-client (6.4.1) +51 more potentially affected by CVE-2026-55471 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (5.6.97)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 5.6.97 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin 6.4.1 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.41), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.41) +6 more potentially affected by CVE-2026-55471 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (5.6.41)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 5.6.41 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.41 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.4.2), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.4.2) +5 more potentially affected by CVE-2026-55471 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (5.4.2)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 5.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.4.2 -...