Skip to contentHapifhir Hl7 Fhir Core vulnerabilities
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactoryCVE-2026-55471Fix available8.7 High
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoSCVE-2026-55470Fix available7.5 High
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token TheftCVE-2026-34361Fix available9.3 Critical
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network ProbingCVE-2026-34360Fix available5.8 Medium
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR CoreCVE-2026-34359Fix available7.4 High
- hapifhir org.hl7.fhir.core, hl7 fhir core +1 moreXXE vulnerability in XSLT parsing in `org.hl7.fhir.core`CVE-2024-52007Fix available8.6 High
- hapifhir hl7 fhir coreHL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057CVE-2023-28465Public exploitFix available7.5 High
- hapifhir hl7 fhir core, hl7 fhir ig publisher +1 moreMITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core`CVE-2023-24057Fix available8.1 High