GitHub Advisoryadvisory · Maven

GHSA-p7m9-v2cm-2h7m HAPI FHIR HTTP authentication leak in redirects

CRITICAL Published 2026-03-18 Modified 2026-03-25 Official page ↗
Aliases
CVE-2026-33180
Ecosystem
Maven
Packages
ca.uhn.hapi.fhir:org.hl7.fhir.utilities, ca.uhn.hapi.fhir:org.hl7.fhir.convertors, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, ca.uhn.hapi.fhir:org.hl7.fhir.dstu3, ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may, ca.uhn.hapi.fhir:org.hl7.fhir.model, ca.uhn.hapi.fhir:org.hl7.fhir.r4, ca.uhn.hapi.fhir:org.hl7.fhir.r4b, ca.uhn.hapi.fhir:org.hl7.fhir.r5, ca.uhn.hapi.fhir:org.hl7.fhir.validation, ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-200
Reviewed
2026-03-18

Affected packages

• Maven ca.uhn.hapi.fhir:org.hl7.fhir.utilities: < 6.9.0 → fixed in 6.9.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.convertors: < 6.9.0 → fixed in 6.9.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu2: < 6.9.0 → fixed in 6.9.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu3: < 6.9.0 → fixed in 6.9.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support: < 6.9.0 → fixed in 6.9.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may: < 6.9.0 → fixed in 6.9.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.model: < 6.9.0 → fixed in 6.9.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.r4: < 6.9.0 → fixed in 6.9.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.r4b: < 6.9.0 → fixed in 6.9.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.r5: < 6.9.0 → fixed in 6.9.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation: < 6.9.0 → fixed in 6.9.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli: < 6.9.0 → fixed in 6.9.0

Description

Impact When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is a problem as this header often contains privacy sensitive information or data that could allow others to impersonate the client's request. Patches This issue has been patched in release 6.8.3 Workarounds None.

Related

Alias · CVE (1)

  • CVE-2026-33180 HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References