CVE-2024-51132

HAPI FHIR XML External Entity (XXE) vulnerability

9.8 CriticalPublic exploitFix available

An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.90%Up 1.9 points since Nov 6, 2024

What each source reports

CVE List Score used 9.8

Record: CVE-2024-51132
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-611
Updated: 2026-11-02

EUVDEUVD-2024-3191 9.8

Record: EUVD-2024-3191
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4cf2-cxp3-rjr7 8.8

HAPI FHIR XML External Entity (XXE) vulnerability

Record: GHSA-4cf2-cxp3-rjr7
CVSS 4.0: 8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-601, CWE-611
Updated: 2026-11-02

NVD 9.8

Record: CVE-2024-51132
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-611
Updated: 2026-11-02

OSV 9.8

Record: CVE-2024-51132
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-4cf2-cxp3-rjr7 8.8

HAPI FHIR XML External Entity (XXE) vulnerability

Record: GHSA-4cf2-cxp3-rjr7
CVSS 4.0: 8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-601, CWE-611
Updated: 2026-11-02

OSVROOT-APP-MAVEN-CVE-2024-51132 No score

CVE-2024-51132 in ca.uhn.hapi.fhir:org.hl7.fhir.utilities - Patched by Root

Root has patched CVE-2024-51132 in the ca.uhn.hapi.fhir:org.hl7.fhir.utilities package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2024-51132
Updated: 2026-11-02

Affected products

fhir hapi fhir

Affected packages

Affected packages
Package	Affected	Fixed
`ca.uhn.hapi.fhir:org.hl7.fhir.convertors` Maven	before 6.4.0	6.4.0
`ca.uhn.hapi.fhir:org.hl7.fhir.dstu2` Maven	before 6.4.0	6.4.0
`ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may` Maven	before 6.4.0	6.4.0
`ca.uhn.hapi.fhir:org.hl7.fhir.dstu3` Maven	before 6.4.0	6.4.0
`ca.uhn.hapi.fhir:org.hl7.fhir.r4` Maven	before 6.4.0	6.4.0
`ca.uhn.hapi.fhir:org.hl7.fhir.r4b` Maven	before 6.4.0	6.4.0
`ca.uhn.hapi.fhir:org.hl7.fhir.r5` Maven	before 6.4.0	6.4.0
`ca.uhn.hapi.fhir:org.hl7.fhir.utilities` Maven	before 6.4.0	6.4.0
`ca.uhn.hapi.fhir:org.hl7.fhir.validation` Maven	before 6.4.0	6.4.0
`ca.uhn.hapi.fhir:org.hl7.fhir.convertors` Maven	before 6.4.0, plus listed versions 0.0.10.0.140.0.20.1.181.0.0 Show 45 moreShow less 1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7	6.4.0

Show 26 moreShow less

Affected packages
Package	Affected	Fixed
`ca.uhn.hapi.fhir:org.hl7.fhir.dstu2` Maven	before 6.4.0, plus listed versions 0.0.10.0.140.0.20.1.181.0.0 Show 45 moreShow less 1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7	6.4.0
`ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may` Maven	before 6.4.0, plus listed versions 0.0.10.0.140.0.20.1.181.0.0 Show 45 moreShow less 1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7	6.4.0
`ca.uhn.hapi.fhir:org.hl7.fhir.dstu3` Maven	before 6.4.0, plus listed versions 0.0.10.0.140.0.20.1.181.0.0 Show 45 moreShow less 1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7	6.4.0
`ca.uhn.hapi.fhir:org.hl7.fhir.r4` Maven	before 6.4.0, plus listed versions 0.0.10.0.140.0.20.1.181.0.0 Show 45 moreShow less 1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7	6.4.0
`ca.uhn.hapi.fhir:org.hl7.fhir.r4b` Maven	before 6.4.0, plus listed versions 5.6.1005.6.1015.6.1025.6.1035.6.104 Show 45 moreShow less 5.6.1055.6.1065.6.1075.6.1085.6.1095.6.1105.6.1115.6.1125.6.1135.6.1145.6.1155.6.1165.6.1175.6.225.6.235.6.245.6.255.6.265.6.275.6.285.6.295.6.305.6.315.6.325.6.335.6.345.6.355.6.365.6.375.6.385.6.395.6.405.6.415.6.425.6.435.6.445.6.455.6.465.6.475.6.485.6.505.6.515.6.525.6.535.6.54	6.4.0
`ca.uhn.hapi.fhir:org.hl7.fhir.r5` Maven	before 6.4.0, plus listed versions 0.0.10.0.140.0.20.1.181.0.0 Show 45 moreShow less 1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7	6.4.0
`ca.uhn.hapi.fhir:org.hl7.fhir.utilities` Maven	before 6.4.0, plus listed versions 0.0.10.0.140.0.20.1.181.0.0 Show 45 moreShow less 1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7	6.4.0
`ca.uhn.hapi.fhir:org.hl7.fhir.validation` Maven	before 6.4.0, plus listed versions 0.0.10.0.140.0.20.1.181.0.0 Show 45 moreShow less 1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7	6.4.0
`ca.uhn.hapi.fhir:org.hl7.fhir.utilities` Root:Maven	before 6.0.1-aikido.2	6.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.4.0-aikido.16.4.0-aikido.2
`ca.uhn.hapi.fhir:org.hl7.fhir.dstu2` Root:Maven	before 6.0.1-aikido.2	6.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.4.0-aikido.16.4.0-aikido.2
`ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may` Root:Maven	before 6.0.1-aikido.2	6.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.4.0-aikido.16.4.0-aikido.2
`ca.uhn.hapi.fhir:org.hl7.fhir.dstu3` Root:Maven	before 6.0.1-aikido.2	6.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.4.0-aikido.16.4.0-aikido.2
`ca.uhn.hapi.fhir:org.hl7.fhir.r4` Root:Maven	before 6.0.1-aikido.2	6.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.4.0-aikido.16.4.0-aikido.2
`ca.uhn.hapi.fhir:org.hl7.fhir.r4b` Root:Maven	before 6.0.1-aikido.2	6.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.4.0-aikido.2
`ca.uhn.hapi.fhir:org.hl7.fhir.r5` Root:Maven	before 6.0.1-aikido.2	6.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.4.0-aikido.16.4.0-aikido.2
`ca.uhn.hapi.fhir:org.hl7.fhir.validation` Root:Maven	before 6.0.1-aikido.2	6.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.4.0-aikido.16.4.0-aikido.2
`ca.uhn.hapi.fhir:org.hl7.fhir.convertors` Root:Maven	before 6.0.1-aikido.2	6.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.4.0-aikido.16.4.0-aikido.2
`io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities` Root:Maven	before 6.0.1-root.io.2	6.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.4.0-root.io.16.4.0-root.io.2
`io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu2` Root:Maven	before 6.0.1-root.io.2	6.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.4.0-root.io.16.4.0-root.io.2
`io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may` Root:Maven	before 6.0.1-root.io.2	6.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.4.0-root.io.16.4.0-root.io.2
`io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu3` Root:Maven	before 6.0.1-root.io.2	6.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.4.0-root.io.16.4.0-root.io.2
`io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r4` Root:Maven	before 6.0.1-root.io.2	6.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.4.0-root.io.16.4.0-root.io.2
`io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r4b` Root:Maven	before 6.0.1-root.io.2	6.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.4.0-root.io.2
`io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r5` Root:Maven	before 6.0.1-root.io.2	6.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.4.0-root.io.16.4.0-root.io.2
`io.root.ca.uhn.hapi.fhir:org.hl7.fhir.validation` Root:Maven	before 6.0.1-root.io.2	6.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.4.0-root.io.16.4.0-root.io.2
`io.root.ca.uhn.hapi.fhir:org.hl7.fhir.convertors` Root:Maven	before 6.0.1-root.io.2	6.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.4.0-root.io.16.4.0-root.io.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	JAckLosingHeart/CVE-2024-51132-POC	2024-11-02

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-51132 is a critical vulnerability (CVSS 9.8) in Fhir Hapi Fhir, published November 5, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.90%, the 79th percentile. Fixed in ca.uhn.hapi.fhir:org.hl7.fhir.convertors 6.4.0.

References

This page doesn't list everything

Left out here: 2,312 versions. The JSON record has them.