org.hl7.fhir.core vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

OR

Product

org.hl7.fhir.core

by hapifhir · last CVE Sep 16, 2026

14

CVEs

0

On KEV

9.3

Max CVSS

0

New 30D

Vulnerabilities14 In the news0 Timeline

Severity mix

Critical 3High 9Medium 2Low 0

Severity

All severities14 Critical3 High9 Medium2 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add org.hl7.fhir.core to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-45294	8.6	1%	Sep 6	`org.hl7.fhir.core` XXE vulnerability in XSLT transforms Affected: < 6.3.23
CVE-2026-81876	7.5	1%	Sep 16	HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service Affected: < 6.9.12
CVE-2026-81875	7.5	1%	Sep 16	HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service Affected: < 6.9.12
CVE-2026-62296	7.5	0%	Aug 7	HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service Affected: < 6.9.11
CVE-2026-62295	7.5	0%	Aug 7	HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service Affected: < 6.9.11
CVE-2026-49485	7.5	1%	Jul 17	HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint Affected: < 6.9.4.2; >= 6.9.5, < 6.9.9
CVE-2026-45367	7.5	1%	Jul 16	HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint Affected: < 6.9.7
CVE-2026-55470	7.5	1%	Jul 8	HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS Affected: < 6.9.10
CVE-2026-33180	7.5	0%	Mar 20	HAPI FHIR HTTP authentication leak in redirects Affected: < 6.9.0