Critical severity · published Jul 8, 2026
CVE-2026-55471
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
9.1
CVSS
0.6%
EPSS
No
On KEV
Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform(...) overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET restrictions, allowing an attacker who controls or can tamper with transformed XML to trigger XML External Entity injection for local file disclosure and blind XXE or SSRF to arbitrary URLs reachable from the host. This issue is fixed in version 6.9.10.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OR
org.hl7.fhir.core · hapifhir
< 6.9.10 · source: vendor
HF
Hl7 Fhir Core · Hapifhir
before 6.9.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-55471
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-55471
Patch
https://github.com/hapifhir/org.hl7.fhir.core/commit/01ca2ecdefec9b33204d2495fe78af8c0dc52298
Release Notes
https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.10
Exploit
https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2f55-g35j-5jmf
More from org.hl7.fhir.core
9.3
CVE-2026-34361
HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
9.1
CVE-2026-34359
HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core
8.6
CVE-2024-45294
`org.hl7.fhir.core` XXE vulnerability in XSLT transforms
7.5
CVE-2026-81876
HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
7.5
CVE-2026-81875
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service