CVE-2026-34361

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the FHIR Validator HTTP service exposes an unauthenticated "/loadIG" endpoint that makes outbound HTTP requests to attacker-controlled URLs. Combined with a startsWith...

CVE-2026-34361

creationtimestamp| type| source ---|---|--- 2026-03-27 13:35:01+00:00| published-proof-of-concept| https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-vr79-8m62-wh98 2026-03-31 17:28:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miepa2j5jo2d 2026-03-3...