hapifhir vulnerabilities

CVEs per yearBy the year they were published

1. 20242
2. 202613

Newest CVEs

• CVE-2026-81876

  HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

  hapifhir · org.hl7.fhir.core

  High7.5
• CVE-2026-81875

  HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service

  hapifhir · org.hl7.fhir.core

  High7.5
• CVE-2026-62296

  HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service

  hapifhir · org.hl7.fhir.core

  High7.5
• CVE-2026-62295

  HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service

  hapifhir · org.hl7.fhir.core

  High7.5
• CVE-2026-62293

  HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles

  hapifhir · org.hl7.fhir.core

  Medium5.0
• CVE-2026-49485

  HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

  hapifhir · org.hl7.fhir.core

  High7.5
• CVE-2026-45367

  HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

  hapifhir · org.hl7.fhir.core

  High7.5
• CVE-2026-55471

  HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

  hapifhir · org.hl7.fhir.core

  High8.7
• CVE-2026-55470

  HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

  hapifhir · org.hl7.fhir.core

  High7.5
• CVE-2026-34361

  HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft

  hapifhir · org.hl7.fhir.core

  Critical9.3