CVE-2026-45367

HIGH7.5

HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

Published Jul 16, 2026

Modified 1 months ago

Details

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.

References

WEB

https://github.com/hapifhir/org.hl7.fhir.core/commit/275d015c680ce9f90cbe285596e50118e472bf24

WEB

https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed

WEB

https://github.com/hapifhir/org.hl7.fhir.core/pull/2403

WEB

https://github.com/hapifhir/org.hl7.fhir.core/pull/2463

WEB

https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.7

WEB