ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.1.12), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.1.12) +3 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.1.12)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.1.12 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.1.12 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.4.2), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.4.2) potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.4.2)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.4.2 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.4.6), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.4.6) potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.4.6)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.4.6 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.5.6), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.5.6) potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.5.6)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.5.6 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.1.18), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.1.18) potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.1.18)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.1.18 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.1.18 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.2.20), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.2.20) potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.2.20)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.2.20 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.2.20 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (4.1.0), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (4.1.0) +70 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (4.1.0)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 4.1.0 - ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver 4.1.0 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.85), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.85) +3 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4b (5.6.85)

ca.uhn.hapi.fhir:org.hl7.fhir.r4b MAVEN version 5.6.85 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4b and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.85 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (>=6.4.2, <=6.4.7), ca.uhn.hapi.fhir:hapi-fhir-base-test-mindeps-client (>=6.4.2, <=6.4.7) +81 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.6.971)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.6.971 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin =6.4.2, =6.4.2, =6.4.2, =6.4.2,...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.20), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.0.20) potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.0.20)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.0.20 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.13), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.13) potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.13)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.13 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.13 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.79), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.79) +3 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.79)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.79 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.79 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.116), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.116) +4 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.116)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.116 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.116 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=4.0.0, <=4.0.1), ca.uhn.hapi.fhir:hapi-fhir-igpacks (>=4.0.0, <=4.0.1) +6 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (4.0.0)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.6.0, <=8.10.0), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.6.0, <=7.4.5) +157 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (>=6.0.0, <=6.9.4.1)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version =6.0.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.8.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.4.0, =6.8.0, =6.6.0, =8.10.0 and more Source cves: CVE-2026-45367 Source advisory: OSV:GHSA-3653-68V6-RQ57...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.78), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.78) +3 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4b (5.6.78)

ca.uhn.hapi.fhir:org.hl7.fhir.r4b MAVEN version 5.6.78 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4b and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.78 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.12), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.0.12) +3 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (5.0.12)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may MAVEN version 5.0.12 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.0.12 -...

HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The FHIRPath functions matches, matchesFull, and replaceMatches pass user-controlled regular expressions directly to Java's Pattern.compile and String.replaceAll without...

HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The FHIRPath functions matches, matchesFull, and replaceMatches pass user-controlled regular expressions directly to Java's Pattern.compile and String.replaceAll without...

WS-2020-0113

Apollo-server-hapi before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable name...