Hapifhir vulnerabilities

Products

• Org.hl7.fhir.core 15
• Hl7 Fhir Core 8
• Ca.uhn.hapi.fhir:org.hl7.fhir.validation 3
• Ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli 3
• Ca.uhn.hapi.fhir:org.hl7.fhir.r5 2
• Ca.uhn.hapi.fhir:org.hl7.fhir.utilities 2

Newest

• hapifhir org.hl7.fhir.core HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service CVE-2026-81876 Fix available 7.5 HighSeptember 16, 2026
• hapifhir org.hl7.fhir.core HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service CVE-2026-81875 Fix available 7.5 HighSeptember 16, 2026
• hapifhir ca.uhn.hapi.fhir:org.hl7.fhir.r5, ca.uhn.hapi.fhir:org.hl7.fhir.utilities, ca.uhn.hapi.fhir:org.hl7.fhir.validation +2 more +4 more HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service CVE-2026-62296 7.5 HighAugust 7, 2026
• hapifhir ca.uhn.hapi.fhir:org.hl7.fhir.r5, ca.uhn.hapi.fhir:org.hl7.fhir.utilities, ca.uhn.hapi.fhir:org.hl7.fhir.validation +2 more +4 more HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service CVE-2026-62295 7.5 HighAugust 7, 2026
• hapifhir ca.uhn.hapi.fhir:org.hl7.fhir.validation, ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli, org.hl7.fhir.core +2 more HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles CVE-2026-62293 5.0 MediumAugust 7, 2026
• hapifhir org.hl7.fhir.core HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint CVE-2026-49485 Fix available 7.5 HighJuly 9, 2026
• hapifhir hl7 fhir core, org.hl7.fhir.core +1 more HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory CVE-2026-55471 Fix available 8.7 HighJune 17, 2026
• hapifhir hl7 fhir core, org.hl7.fhir.core +1 more HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS CVE-2026-55470 Fix available 7.5 HighJune 17, 2026
• hapifhir org.hl7.fhir.core HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint CVE-2026-45367 Fix available 7.5 HighMay 18, 2026
• hapifhir hl7 fhir core, org.hl7.fhir.core +1 more HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft CVE-2026-34361 Fix available 9.3 CriticalMarch 30, 2026
• hapifhir hl7 fhir core, org.hl7.fhir.core +1 more HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing CVE-2026-34360 Fix available 5.8 MediumMarch 30, 2026
• hapifhir hl7 fhir core, org.hl7.fhir.core +1 more HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core CVE-2026-34359 Fix available 7.4 HighMarch 30, 2026
• hapifhir org.hl7.fhir.core, red hat fuse 7 +1 more HAPI FHIR HTTP authentication leak in redirects CVE-2026-33180 Fix available 7.5 HighMarch 18, 2026
• hapifhir org.hl7.fhir.core, hl7 fhir core +1 more XXE vulnerability in XSLT parsing in `org.hl7.fhir.core` CVE-2024-52007 Fix available 8.6 HighNovember 8, 2024
• hapifhir org.hl7.fhir.core `org.hl7.fhir.core` XXE vulnerability in XSLT transforms CVE-2024-45294 Fix available 8.6 HighSeptember 6, 2024
• hapifhir hl7 fhir core HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057 CVE-2023-28465 Public exploitFix available 7.5 HighMarch 10, 2023
• hapifhir hl7 fhir core, hl7 fhir ig publisher +1 more MITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core` CVE-2023-24057 Fix available 8.1 HighJanuary 23, 2023
• hapifhir testpage overlay Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to... CVE-2020-24301 6.1 MediumOctober 8, 2020