OR
Product
org.hl7.fhir.core
14
CVEs
0
On KEV
9.3
Max CVSS
0
New 30D
Severity mix
Critical 3High 9Medium 2Low 0
Watch
Add org.hl7.fhir.core to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-34361 | 9.3 | Mar 31 | HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft Affected: < 6.9.4 |
| CVE-2026-55471 | 9.1 | Jul 8 | HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory Affected: < 6.9.10 |
| CVE-2026-34359 | 9.1 | Mar 31 | HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core Affected: < 6.9.4 |
| CVE-2024-45294 | 8.6 | Sep 6 | `org.hl7.fhir.core` XXE vulnerability in XSLT transforms Affected: < 6.3.23 |
| CVE-2026-81876 | 7.5 | Sep 16 | HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service Affected: < 6.9.12 |
| CVE-2026-81875 | 7.5 | Sep 16 | HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service Affected: < 6.9.12 |
| CVE-2026-62296 | 7.5 | Aug 7 | HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service Affected: < 6.9.11 |
| CVE-2026-62295 | 7.5 | Aug 7 | HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service Affected: < 6.9.11 |
| CVE-2026-49485 | 7.5 | Jul 17 | HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint Affected: < 6.9.4.2; >= 6.9.5, < 6.9.9 |
| CVE-2026-45367 | 7.5 | Jul 16 | HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint Affected: < 6.9.7 |
| CVE-2026-55470 | 7.5 | Jul 8 | HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS Affected: < 6.9.10 |
| CVE-2026-33180 | 7.5 | Mar 20 | HAPI FHIR HTTP authentication leak in redirects Affected: < 6.9.0 |
| CVE-2026-34360 | 5.8 | Mar 31 | HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing Affected: < 6.9.4 |
| CVE-2026-62293 | 5.0 | Aug 7 | HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles Affected: < 6.9.11 |
Showing 14