High severity · published Jul 16, 2026
CVE-2026-45367
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OR
org.hl7.fhir.core · hapifhir
< 6.9.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45367
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45367
github.com
https://github.com/hapifhir/org.hl7.fhir.core/commit/275d015c680ce9f90cbe285596e50118e472bf24
github.com
https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed
github.com
https://github.com/hapifhir/org.hl7.fhir.core/pull/2403
github.com
https://github.com/hapifhir/org.hl7.fhir.core/pull/2463
github.com
https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.7
github.com
https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3653-68v6-rq57
More from org.hl7.fhir.core
9.3
CVE-2026-34361
HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
9.1
CVE-2026-55471
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
9.1
CVE-2026-34359
HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core
8.6
CVE-2024-45294
`org.hl7.fhir.core` XXE vulnerability in XSLT transforms
7.5
CVE-2026-81876
HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service