Skip to contentHapifhir Org.hl7.fhir.core vulnerabilities
- hapifhir org.hl7.fhir.coreHAPI FHIR: SHCParser DEFLATE infinite loop causes denial of serviceCVE-2026-81876Fix available7.5 High
- hapifhir org.hl7.fhir.coreHAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of serviceCVE-2026-81875Fix available7.5 High
- hapifhir ca.uhn.hapi.fhir:org.hl7.fhir.r5, ca.uhn.hapi.fhir:org.hl7.fhir.utilities, ca.uhn.hapi.fhir:org.hl7.fhir.validation +2 more +4 moreHAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of serviceCVE-2026-622967.5 High
- hapifhir ca.uhn.hapi.fhir:org.hl7.fhir.r5, ca.uhn.hapi.fhir:org.hl7.fhir.utilities, ca.uhn.hapi.fhir:org.hl7.fhir.validation +2 more +4 moreHAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of serviceCVE-2026-622957.5 High
- hapifhir ca.uhn.hapi.fhir:org.hl7.fhir.validation, ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli, org.hl7.fhir.core +2 moreHAPI FHIR: Stored XSS in scan report via unescaped IG and profile titlesCVE-2026-622935.0 Medium
- hapifhir org.hl7.fhir.coreHAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP EndpointCVE-2026-49485Fix available7.5 High
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactoryCVE-2026-55471Fix available8.7 High
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoSCVE-2026-55470Fix available7.5 High
- hapifhir org.hl7.fhir.coreHAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP EndpointCVE-2026-45367Fix available7.5 High
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token TheftCVE-2026-34361Fix available9.3 Critical
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network ProbingCVE-2026-34360Fix available5.8 Medium
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR CoreCVE-2026-34359Fix available7.4 High
- hapifhir org.hl7.fhir.core, red hat fuse 7 +1 moreHAPI FHIR HTTP authentication leak in redirectsCVE-2026-33180Fix available7.5 High
- hapifhir org.hl7.fhir.core, hl7 fhir core +1 moreXXE vulnerability in XSLT parsing in `org.hl7.fhir.core`CVE-2024-52007Fix available8.6 High
- hapifhir org.hl7.fhir.core`org.hl7.fhir.core` XXE vulnerability in XSLT transformsCVE-2024-45294Fix available8.6 High