Vulnerability · Published Mar 20, 2026 · Assigned by GitHub_M
CVE-2026-33180HAPI FHIR HTTP authentication leak in redirects
High 7.5
In plain English
A high-severity information exposure in org.hl7.fhir.core from hapifhir. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.0, when setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is a problem as this header often contains privacy sensitive information or data that could allow others to impersonate the client's request. This issue has been patched in release 6.9.0. No known workarounds are available.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.convertors | 6.9.0 | GHSA-p7m9-v2cm-2h7m |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 | 6.9.0 | GHSA-p7m9-v2cm-2h7m |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may | 6.9.0 | GHSA-p7m9-v2cm-2h7m |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 | 6.9.0 | GHSA-p7m9-v2cm-2h7m |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support | 6.9.0 | GHSA-p7m9-v2cm-2h7m |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.model | 6.9.0 | GHSA-p7m9-v2cm-2h7m |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r4 | 6.9.0 | GHSA-p7m9-v2cm-2h7m |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r4b | 6.9.0 | GHSA-p7m9-v2cm-2h7m |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r5 | 6.9.0 | GHSA-p7m9-v2cm-2h7m |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.utilities | 6.9.0 | GHSA-p7m9-v2cm-2h7m |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.validation | 6.9.0 | GHSA-p7m9-v2cm-2h7m |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli | 6.9.0 | GHSA-p7m9-v2cm-2h7m |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hapifhir | org.hl7.fhir.core | < 6.9.0 |
Weakness: CWE-200, CWE-201 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-p7m9-v2cm-2h7m x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-33180 vdb-entry, x_refsource_REDHAT
- RHBZ#2449841 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33180.json x_sadp-csaf-vex