ca.uhn.hapi.fhir:hapi-fhir-cli-api (5.1.0), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (5.1.0) +44 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.1.0)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 5.1.0 -...

dev.dsf:dsf-bpe-server-jetty (1.0.0-m1), dev.dsf:dsf-fhir-server-jetty (1.0.0-m1) potentially affected by CVE-2026-40939 via dev.dsf:dsf-common-jetty (1.0.0-m1)

dev.dsf:dsf-common-jetty MAVEN version 1.0.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on dev.dsf:dsf-common-jetty and may be impacted: - dev.dsf:dsf-bpe-server-jetty 1.0.0-m1 - dev.dsf:dsf-fhir-server-jetty 1.0.0-m1 Source cves: CVE-2026-40939...

dev.dsf:dsf-fhir-server-jetty (1.3.2) potentially affected by CVE-2026-40939 via dev.dsf:dsf-fhir-server (1.3.2)

dev.dsf:dsf-fhir-server MAVEN version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on dev.dsf:dsf-fhir-server and may be impacted: - dev.dsf:dsf-fhir-server-jetty 1.3.2 Source cves: CVE-2026-40939 Source advisory: OSV:GHSA-GJ7P-595X-QWF5...

dev.dsf:dsf-fhir-server-jetty (1.8.0), dev.dsf:dsf-tools-test-data-generator (1.8.0) potentially affected by CVE-2026-40939 via dev.dsf:dsf-fhir-server (1.8.0)

dev.dsf:dsf-fhir-server MAVEN version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on dev.dsf:dsf-fhir-server and may be impacted: - dev.dsf:dsf-fhir-server-jetty 1.8.0 - dev.dsf:dsf-tools-test-data-generator 1.8.0 Source cves: CVE-2026-40939...

dev.dsf:dsf-bpe-server-jetty (1.5.0), dev.dsf:dsf-fhir-server-jetty (1.5.0) potentially affected by CVE-2026-40939 via dev.dsf:dsf-common-jetty (1.5.0)

dev.dsf:dsf-common-jetty MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on dev.dsf:dsf-common-jetty and may be impacted: - dev.dsf:dsf-bpe-server-jetty 1.5.0 - dev.dsf:dsf-fhir-server-jetty 1.5.0 Source cves: CVE-2026-40939 Source...

dev.dsf:dsf-fhir-server-jetty (1.2.0-rc1), dev.dsf:dsf-tools-test-data-generator (1.2.0-rc1) potentially affected by CVE-2026-40939 via dev.dsf:dsf-fhir-server (1.2.0-rc1)

dev.dsf:dsf-fhir-server MAVEN version 1.2.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dev.dsf:dsf-fhir-server and may be impacted: - dev.dsf:dsf-fhir-server-jetty 1.2.0-rc1 - dev.dsf:dsf-tools-test-data-generator 1.2.0-rc1 Source cves:...

dev.dsf:dsf-bpe-server-jetty (1.2.0-rc1), dev.dsf:dsf-fhir-server-jetty (1.2.0-rc1) potentially affected by CVE-2026-40939 via dev.dsf:dsf-common-jetty (1.2.0-rc1)

dev.dsf:dsf-common-jetty MAVEN version 1.2.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dev.dsf:dsf-common-jetty and may be impacted: - dev.dsf:dsf-bpe-server-jetty 1.2.0-rc1 - dev.dsf:dsf-fhir-server-jetty 1.2.0-rc1 Source cves: CVE-2026-4093...

dev.dsf:dsf-bpe-server-jetty (1.3.1), dev.dsf:dsf-fhir-server-jetty (1.3.1) potentially affected by CVE-2026-40939 via dev.dsf:dsf-common-jetty (1.3.1)

dev.dsf:dsf-common-jetty MAVEN version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on dev.dsf:dsf-common-jetty and may be impacted: - dev.dsf:dsf-bpe-server-jetty 1.3.1 - dev.dsf:dsf-fhir-server-jetty 1.3.1 Source cves: CVE-2026-40939 Source...

dev.dsf:dsf-bpe-server-jetty (1.1.0), dev.dsf:dsf-fhir-server-jetty (1.1.0) potentially affected by CVE-2026-40939 via dev.dsf:dsf-common-jetty (1.1.0)

dev.dsf:dsf-common-jetty MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on dev.dsf:dsf-common-jetty and may be impacted: - dev.dsf:dsf-bpe-server-jetty 1.1.0 - dev.dsf:dsf-fhir-server-jetty 1.1.0 Source cves: CVE-2026-40939 Source...

dev.dsf:dsf-fhir-server-jetty (1.1.0), dev.dsf:dsf-tools-test-data-generator (1.1.0) potentially affected by CVE-2026-40939 via dev.dsf:dsf-fhir-server (1.1.0)

dev.dsf:dsf-fhir-server MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on dev.dsf:dsf-fhir-server and may be impacted: - dev.dsf:dsf-fhir-server-jetty 1.1.0 - dev.dsf:dsf-tools-test-data-generator 1.1.0 Source cves: CVE-2026-40939...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the DSF FHIR and BPE Servers with enabled OIDC authentication due to the lack of session timeout enforcement in OIDC browser sessions. An attacker can gain unauthorized access to a user's session by...

dev.dsf:dsf-fhir-server-jetty (1.7.1), dev.dsf:dsf-tools-test-data-generator (1.7.1) potentially affected by CVE-2026-40939 via dev.dsf:dsf-fhir-server (1.7.1)

dev.dsf:dsf-fhir-server MAVEN version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on dev.dsf:dsf-fhir-server and may be impacted: - dev.dsf:dsf-fhir-server-jetty 1.7.1 - dev.dsf:dsf-tools-test-data-generator 1.7.1 Source cves: CVE-2026-40939...

PT-2026-35189

Affected Components - DSF FHIR Server with enabled bearer-token authentication or back-channel logout. - DSF BPE Server with enabled bearer-token authentication or back-channel logout. - DSF BPE Server API v2 process plugins using FHIR client connections with configured OIDC authentication. Summa...

dev.dsf:dsf-bpe-server-jetty (>=1.0.0-m1, <=1.1.0), dev.dsf:dsf-common-jetty (>=1.0.0-m1, <=1.1.0) +1 more potentially affected by CVE-2023-41900 via org.eclipse.jetty:jetty-openid (11.0.15)

org.eclipse.jetty:jetty-openid MAVEN version 11.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-openid and may be impacted: - dev.dsf:dsf-bpe-server-jetty =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.1.0 Source cves: CVE-2023-41900...

dev.dsf:dsf-bpe-server-jetty (>=1.0.0-m1, <=1.1.0), dev.dsf:dsf-common-jetty (>=1.0.0-m1, <=1.1.0) +1 more potentially affected by CVE-2023-41900 via org.eclipse.jetty:jetty-openid (11.0.15)

org.eclipse.jetty:jetty-openid MAVEN version 11.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-openid and may be impacted: - dev.dsf:dsf-bpe-server-jetty =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.1.0 Source cves: CVE-2023-41900...