CVEvulnerability
CVE-2026-45367
7.5 HIGH
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-07-16
- Last modified
- 2026-10-24
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-1333
Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.
Related
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness
References
- https://github.com/hapifhir/org.hl7.fhir.core/commit/275d015c680ce9f90cbe285596e50118e472bf24 github.com
- https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed github.com
- https://github.com/hapifhir/org.hl7.fhir.core/pull/2403 github.com
- https://github.com/hapifhir/org.hl7.fhir.core/pull/2463 github.com
- https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.7 github.com
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3653-68v6-rq57 github.com