Vulnerability · Published Jul 8, 2026 · Assigned by GitHub_M
CVE-2026-55470HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
High 7.5
In plain English
A high-severity regular-expression denial of service in org.hl7.fhir.core from hapifhir. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches() in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matches(sw) without RegexTimeout protection while replaceMatches() was updated, allowing an unauthenticated attacker to trigger catastrophic regex backtracking and exhaust server CPU. This issue is fixed in version 6.9.10.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.convertors | 6.9.10 | GHSA-fxj4-p9xp-37v5 |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 | 6.9.10 | GHSA-fxj4-p9xp-37v5 |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.validation | 6.9.10 | GHSA-fxj4-p9xp-37v5 |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli | 6.9.10 | GHSA-fxj4-p9xp-37v5 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hapifhir | org.hl7.fhir.core | < 6.9.10 |
Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H