Vulnerability · Published Jul 16, 2026 · Assigned by GitHub_M

CVE-2026-45367HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

High 7.5

In plain English

A high-severity regular-expression denial of service in org.hl7.fhir.core from hapifhir. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.7%top 47.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	ca.uhn.hapi.fhir:org.hl7.fhir.dstu2	6.9.7	GHSA-3653-68v6-rq57
Maven	ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may	6.9.7	GHSA-3653-68v6-rq57
Maven	ca.uhn.hapi.fhir:org.hl7.fhir.dstu3	6.9.7	GHSA-3653-68v6-rq57
Maven	ca.uhn.hapi.fhir:org.hl7.fhir.r4	6.9.7	GHSA-3653-68v6-rq57
Maven	ca.uhn.hapi.fhir:org.hl7.fhir.r4b	6.9.7	GHSA-3653-68v6-rq57
Maven	ca.uhn.hapi.fhir:org.hl7.fhir.r5	6.9.7	GHSA-3653-68v6-rq57
Maven	ca.uhn.hapi.fhir:org.hl7.fhir.validation	6.9.7	GHSA-3653-68v6-rq57
Maven	ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli	6.9.7	GHSA-3653-68v6-rq57

Affected products (as reported)

Vendor	Product	Versions
hapifhir	org.hl7.fhir.core	< 6.9.7

Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3653-68v6-rq57 x_refsource_CONFIRM
https://github.com/hapifhir/org.hl7.fhir.core/pull/2403 x_refsource_MISC
https://github.com/hapifhir/org.hl7.fhir.core/pull/2463 x_refsource_MISC
https://github.com/hapifhir/org.hl7.fhir.core/commit/275d015c680ce9f90cbe285596e50118e472bf24 x_refsource_MISC
https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed x_refsource_MISC
https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.7 x_refsource_MISC