CVE-2026-33180
HAPI FHIR HTTP authentication leak in redirects
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.0, when setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is a problem as this header often contains privacy sensitive information or data that could allow others to impersonate the client's request. This issue has been patched in release 6.9.0. No known workarounds are available.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
HAPI FHIR HTTP authentication leak in redirects
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.0, when setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is a problem as this header often contains privacy sensitive information or data that could allow others to impersonate the client's request. This issue has been patched in release 6.9.0. No known workarounds are available.
- Record
CVE-2026-33180- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-200, CWE-201
- Updated
- 2026-11-02
EUVDEUVD-2026-13828
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.0, when setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is a problem as this header often contains privacy sensitive information or data that could allow others to impersonate the client's request. This issue has been patched in release 6.9.0. No known workarounds are available.
- Record
EUVD-2026-13828- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p7m9-v2cm-2h7m
HAPI FHIR HTTP authentication leak in redirects
Impact
When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value.
Sending the same set of headers to subsequent hosts is a problem as this header often contains privacy sensitive information or data that could allow others to impersonate the client's request.
Patches
This issue has been patched in release 6.8.3
Workarounds
None.
- Record
GHSA-p7m9-v2cm-2h7m- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.0, when setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is a problem as this header often contains privacy sensitive information or data that could allow others to impersonate the client's request. This issue has been patched in release 6.9.0. No known workarounds are available.
- Record
CVE-2026-33180- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-200, CWE-201
- Updated
- 2026-11-02
OSV
HAPI FHIR HTTP authentication leak in redirects
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.0, when setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is a problem as this header often contains privacy sensitive information or data that could allow others to impersonate the client's request. This issue has been patched in release 6.9.0. No known workarounds are available.
- Record
CVE-2026-33180- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-p7m9-v2cm-2h7m
HAPI FHIR HTTP authentication leak in redirects
Impact
When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value.
Sending the same set of headers to subsequent hosts is a problem as this header often contains privacy sensitive information or data that could allow others to impersonate the client's request.
Patches
This issue has been patched in release 6.8.3
Workarounds
None.
- Record
GHSA-p7m9-v2cm-2h7m- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-33180 No score
CVE-2026-33180 in ca.uhn.hapi.fhir:org.hl7.fhir.utilities - Patched by Root
Root has patched CVE-2026-33180 in the ca.uhn.hapi.fhir:org.hl7.fhir.utilities package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-33180- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ca.uhn.hapi.fhir:org.hl7.fhir.utilitiesMaven |
before 6.9.0 | 6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.convertorsMaven |
before 6.9.0 | 6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2Maven |
before 6.9.0 | 6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3Maven |
before 6.9.0 | 6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.supportMaven |
before 6.9.0 | 6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016mayMaven |
before 6.9.0 | 6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.modelMaven |
before 6.9.0 | 6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.r4Maven |
before 6.9.0 | 6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.r4bMaven |
before 6.9.0 | 6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.r5Maven |
before 6.9.0 | 6.9.0 |
Show 36 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ca.uhn.hapi.fhir:org.hl7.fhir.validationMaven |
before 6.9.0 | 6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.validation.cliMaven |
before 6.9.0 | 6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.utilitiesMaven |
before 6.9.0, plus listed versions 0.0.10.0.140.0.20.1.181.0.0 Show 45 moreShow less1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7 |
6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.convertorsMaven |
before 6.9.0, plus listed versions 0.0.10.0.140.0.20.1.181.0.0 Show 45 moreShow less1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7 |
6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2Maven |
before 6.9.0, plus listed versions 0.0.10.0.140.0.20.1.181.0.0 Show 45 moreShow less1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7 |
6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3Maven |
before 6.9.0, plus listed versions 0.0.10.0.140.0.20.1.181.0.0 Show 45 moreShow less1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7 |
6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.supportMaven |
before 6.9.0, plus listed versions 6.6.06.6.16.6.26.6.36.6.4 Show 18 moreShow less6.6.56.6.66.6.76.7.06.7.16.7.106.7.116.7.26.7.36.7.46.7.56.7.66.7.76.7.86.7.96.8.06.8.16.8.2 |
6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016mayMaven |
before 6.9.0, plus listed versions 0.0.10.0.140.0.20.1.181.0.0 Show 45 moreShow less1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7 |
6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.modelMaven |
before 6.9.0, plus listed versions 6.5.256.5.266.5.276.5.286.6.0 Show 22 moreShow less6.6.16.6.26.6.36.6.46.6.56.6.66.6.76.7.06.7.16.7.106.7.116.7.26.7.36.7.46.7.56.7.66.7.76.7.86.7.96.8.06.8.16.8.2 |
6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.r4Maven |
before 6.9.0, plus listed versions 0.0.10.0.140.0.20.1.181.0.0 Show 45 moreShow less1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7 |
6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.r4bMaven |
before 6.9.0, plus listed versions 5.6.1005.6.1015.6.1025.6.1035.6.104 Show 45 moreShow less5.6.1055.6.1065.6.1075.6.1085.6.1095.6.1105.6.1115.6.1125.6.1135.6.1145.6.1155.6.1165.6.1175.6.225.6.235.6.245.6.255.6.265.6.275.6.285.6.295.6.305.6.315.6.325.6.335.6.345.6.355.6.365.6.375.6.385.6.395.6.405.6.415.6.425.6.435.6.445.6.455.6.465.6.475.6.485.6.505.6.515.6.525.6.535.6.54 |
6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.r5Maven |
before 6.9.0, plus listed versions 0.0.10.0.140.0.20.1.181.0.0 Show 45 moreShow less1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7 |
6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.validationMaven |
before 6.9.0, plus listed versions 0.0.10.0.140.0.20.1.181.0.0 Show 45 moreShow less1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7 |
6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.validation.cliMaven |
before 6.9.0, plus listed versions 4.0.04.0.14.0.24.0.34.1.04.2.05.0.0 |
6.9.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.utilitiesRoot:Maven |
before 6.7.9-aikido.7 | 6.7.9-aikido.76.7.9-aikido.66.7.9-aikido.86.7.9-aikido.106.7.9-aikido.96.5.27-aikido.16.4.0-aikido.16.4.0-aikido.26.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.9.0-aikido.86.9.0-aikido.96.9.0-aikido.106.9.0-aikido.11 |
ca.uhn.hapi.fhir:org.hl7.fhir.validationRoot:Maven |
before 6.7.9-aikido.7 | 6.7.9-aikido.76.7.9-aikido.66.7.9-aikido.86.7.9-aikido.106.7.9-aikido.96.4.0-aikido.16.4.0-aikido.26.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.9.0-aikido.86.9.0-aikido.96.9.0-aikido.106.9.0-aikido.11 |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.supportRoot:Maven |
before 6.7.9-aikido.7 | 6.7.9-aikido.76.7.9-aikido.66.7.9-aikido.86.7.9-aikido.106.7.9-aikido.9 |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2Root:Maven |
before 6.7.9-aikido.7 | 6.7.9-aikido.76.7.9-aikido.66.7.9-aikido.86.7.9-aikido.106.7.9-aikido.96.5.27-aikido.16.4.0-aikido.16.4.0-aikido.26.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.9.0-aikido.86.9.0-aikido.96.9.0-aikido.106.9.0-aikido.11 |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016mayRoot:Maven |
before 6.7.9-aikido.7 | 6.7.9-aikido.76.7.9-aikido.66.7.9-aikido.86.7.9-aikido.106.7.9-aikido.96.4.0-aikido.16.4.0-aikido.26.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.9.0-aikido.86.9.0-aikido.96.9.0-aikido.106.9.0-aikido.11 |
ca.uhn.hapi.fhir:org.hl7.fhir.r5Root:Maven |
before 6.7.9-aikido.7 | 6.7.9-aikido.76.7.9-aikido.66.7.9-aikido.86.7.9-aikido.106.7.9-aikido.96.4.0-aikido.16.4.0-aikido.26.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.9.0-aikido.86.9.0-aikido.96.9.0-aikido.106.9.0-aikido.11 |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3Root:Maven |
before 6.7.9-aikido.7 | 6.7.9-aikido.76.7.9-aikido.66.7.9-aikido.86.7.9-aikido.106.7.9-aikido.96.5.27-aikido.16.4.0-aikido.16.4.0-aikido.26.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.9.0-aikido.86.9.0-aikido.96.9.0-aikido.106.9.0-aikido.11 |
ca.uhn.hapi.fhir:org.hl7.fhir.modelRoot:Maven |
before 6.7.9-aikido.7 | 6.7.9-aikido.76.7.9-aikido.66.7.9-aikido.86.7.9-aikido.106.7.9-aikido.9 |
ca.uhn.hapi.fhir:org.hl7.fhir.convertorsRoot:Maven |
before 6.7.9-aikido.7 | 6.7.9-aikido.76.7.9-aikido.66.7.9-aikido.86.7.9-aikido.106.7.9-aikido.96.4.0-aikido.16.4.0-aikido.26.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.9.0-aikido.96.9.0-aikido.106.9.0-aikido.11 |
ca.uhn.hapi.fhir:org.hl7.fhir.r4Root:Maven |
before 6.7.9-aikido.7 | 6.7.9-aikido.76.7.9-aikido.66.7.9-aikido.86.7.9-aikido.106.7.9-aikido.96.4.0-aikido.16.4.0-aikido.26.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.9.0-aikido.86.9.0-aikido.96.9.0-aikido.106.9.0-aikido.11 |
ca.uhn.hapi.fhir:org.hl7.fhir.r4bRoot:Maven |
before 6.7.9-aikido.7 | 6.7.9-aikido.76.7.9-aikido.66.7.9-aikido.86.7.9-aikido.106.7.9-aikido.96.5.27-aikido.16.4.0-aikido.26.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.9.0-aikido.86.9.0-aikido.96.9.0-aikido.106.9.0-aikido.11 |
io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilitiesRoot:Maven |
before 6.7.9-root.io.1 | 6.7.9-root.io.16.7.9-root.io.26.7.9-root.io.46.7.9-root.io.56.7.9-root.io.76.7.9-root.io.66.7.9-root.io.86.7.9-root.io.106.7.9-root.io.96.5.27-root.io.16.4.0-root.io.16.4.0-root.io.26.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.9.0-root.io.36.9.0-root.io.46.9.0-root.io.56.9.0-root.io.66.9.0-root.io.76.9.0-root.io.96.9.0-root.io.86.9.0-root.io.106.9.0-root.io.11 |
io.root.ca.uhn.hapi.fhir:org.hl7.fhir.validationRoot:Maven |
before 6.7.9-root.io.1 | 6.7.9-root.io.16.7.9-root.io.26.7.9-root.io.46.7.9-root.io.56.7.9-root.io.76.7.9-root.io.66.7.9-root.io.86.7.9-root.io.106.7.9-root.io.96.4.0-root.io.16.4.0-root.io.26.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.9.0-root.io.36.9.0-root.io.46.9.0-root.io.56.9.0-root.io.66.9.0-root.io.76.9.0-root.io.96.9.0-root.io.86.9.0-root.io.106.9.0-root.io.11 |
io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.supportRoot:Maven |
before 6.7.9-root.io.1 | 6.7.9-root.io.16.7.9-root.io.26.7.9-root.io.46.7.9-root.io.56.7.9-root.io.76.7.9-root.io.66.7.9-root.io.86.7.9-root.io.106.7.9-root.io.9 |
io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu2Root:Maven |
before 6.7.9-root.io.1 | 6.7.9-root.io.16.7.9-root.io.26.7.9-root.io.46.7.9-root.io.56.7.9-root.io.76.7.9-root.io.66.7.9-root.io.86.7.9-root.io.106.7.9-root.io.96.5.27-root.io.16.4.0-root.io.16.4.0-root.io.26.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.9.0-root.io.56.9.0-root.io.66.9.0-root.io.76.9.0-root.io.96.9.0-root.io.86.9.0-root.io.106.9.0-root.io.11 |
io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016mayRoot:Maven |
before 6.7.9-root.io.1 | 6.7.9-root.io.16.7.9-root.io.26.7.9-root.io.46.7.9-root.io.56.7.9-root.io.76.7.9-root.io.66.7.9-root.io.86.7.9-root.io.106.7.9-root.io.96.4.0-root.io.16.4.0-root.io.26.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.9.0-root.io.56.9.0-root.io.66.9.0-root.io.76.9.0-root.io.96.9.0-root.io.86.9.0-root.io.106.9.0-root.io.11 |
io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r5Root:Maven |
before 6.7.9-root.io.1 | 6.7.9-root.io.16.7.9-root.io.26.7.9-root.io.46.7.9-root.io.56.7.9-root.io.76.7.9-root.io.66.7.9-root.io.86.7.9-root.io.106.7.9-root.io.96.4.0-root.io.16.4.0-root.io.26.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.9.0-root.io.56.9.0-root.io.66.9.0-root.io.76.9.0-root.io.96.9.0-root.io.86.9.0-root.io.106.9.0-root.io.11 |
io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu3Root:Maven |
before 6.7.9-root.io.1 | 6.7.9-root.io.16.7.9-root.io.26.7.9-root.io.46.7.9-root.io.56.7.9-root.io.76.7.9-root.io.66.7.9-root.io.86.7.9-root.io.106.7.9-root.io.96.5.27-root.io.16.4.0-root.io.16.4.0-root.io.26.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.9.0-root.io.56.9.0-root.io.66.9.0-root.io.76.9.0-root.io.86.9.0-root.io.96.9.0-root.io.106.9.0-root.io.11 |
io.root.ca.uhn.hapi.fhir:org.hl7.fhir.modelRoot:Maven |
before 6.7.9-root.io.1 | 6.7.9-root.io.16.7.9-root.io.26.7.9-root.io.46.7.9-root.io.56.7.9-root.io.76.7.9-root.io.66.7.9-root.io.86.7.9-root.io.106.7.9-root.io.9 |
io.root.ca.uhn.hapi.fhir:org.hl7.fhir.convertorsRoot:Maven |
before 6.7.9-root.io.1 | 6.7.9-root.io.16.7.9-root.io.26.7.9-root.io.46.7.9-root.io.56.7.9-root.io.76.7.9-root.io.66.7.9-root.io.86.7.9-root.io.106.7.9-root.io.96.4.0-root.io.16.4.0-root.io.26.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.9.0-root.io.96.9.0-root.io.106.9.0-root.io.11 |
io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r4Root:Maven |
before 6.7.9-root.io.1 | 6.7.9-root.io.16.7.9-root.io.26.7.9-root.io.46.7.9-root.io.56.7.9-root.io.76.7.9-root.io.66.7.9-root.io.86.7.9-root.io.106.7.9-root.io.96.4.0-root.io.16.4.0-root.io.26.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.9.0-root.io.66.9.0-root.io.76.9.0-root.io.86.9.0-root.io.96.9.0-root.io.106.9.0-root.io.11 |
io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r4bRoot:Maven |
before 6.7.9-root.io.2 | 6.7.9-root.io.26.7.9-root.io.46.7.9-root.io.56.7.9-root.io.76.7.9-root.io.66.7.9-root.io.86.7.9-root.io.106.7.9-root.io.96.5.27-root.io.16.4.0-root.io.26.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.9.0-root.io.56.9.0-root.io.66.9.0-root.io.76.9.0-root.io.96.9.0-root.io.86.9.0-root.io.106.9.0-root.io.11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-33180 is a high vulnerability (CVSS 7.5) in Hapifhir Org.hl7.fhir.core, published March 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in ca.uhn.hapi.fhir:org.hl7.fhir.utilities 6.9.0.
References
github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-p7m9-v2cm-2h7m
access.redhat.com/security/cve/CVE-2026-33180
bugzilla.redhat.com/show_bug.cgi?id=2449841
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33180.json
nvd.nist.gov/vuln/detail/CVE-2026-33180
Left out here: 2,834 versions. The JSON record has them.