hapifhir org.hl7.fhir.core

• CVE-2026-81876 High 7.5 HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service 0.6%
• CVE-2026-81875 High 7.5 HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service 0.6%
• CVE-2026-62296 High 7.5 HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service 0.5%
• CVE-2026-62295 High 7.5 HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service 0.5%
• CVE-2026-62293 Medium 5.0 HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles 0.2%
• CVE-2026-49485 High 7.5 HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint 0.7%
• CVE-2026-45367 High 7.5 HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint 0.7%
• CVE-2026-55471 High 8.7 HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory 0.6%
• CVE-2026-55470 High 7.5 HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS 0.7%
• CVE-2026-34361 Critical 9.3 HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft 0.3%
• CVE-2026-34360 Medium 5.8 HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing 0.2%
• CVE-2026-34359 High 7.4 HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core 0.2%
• CVE-2026-33180 High 7.5 HAPI FHIR HTTP authentication leak in redirects 0.3%
• CVE-2024-52007 High 8.6 XXE vulnerability in XSLT parsing in `org.hl7.fhir.core` 0.9%
• CVE-2024-45294 High 8.6 `org.hl7.fhir.core` XXE vulnerability in XSLT transforms 1.0%