HA
Vendor
hapifhir
32
CVEs
0
On KEV
0
New 30D
Products
OR9.3
org.hl7.fhir.core
hapifhir
14 CVEs0 on KEV0 new
HF9.3
Hl7 Fhir Core
Hapifhir
7 CVEs0 on KEV0 new
CA7.5
ca.uhn.hapi.fhir:org.hl7.fhir.validation
hapifhir
3 CVEs0 on KEV0 new
CA7.5
ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli
hapifhir
3 CVEs0 on KEV0 new
CA7.5
ca.uhn.hapi.fhir:org.hl7.fhir.r5
hapifhir
2 CVEs0 on KEV0 new
CA7.5
ca.uhn.hapi.fhir:org.hl7.fhir.utilities
hapifhir
2 CVEs0 on KEV0 new
TO6.1
Testpage Overlay
Hapifhir
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-81876 | OR org.hl7.fhir.core hapifhir | 7.5 | Sep 16 | HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service |
| CVE-2026-81875 | OR org.hl7.fhir.core hapifhir | 7.5 | Sep 16 | HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service |
| CVE-2026-62296 | CA ca.uhn.hapi.fhir:org.hl7.fhir.utilities hapifhir | 7.5 | Aug 7 | HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service |
| CVE-2026-62295 | CA ca.uhn.hapi.fhir:org.hl7.fhir.r5 hapifhir | 7.5 | Aug 7 | HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service |
| CVE-2026-62293 | OR org.hl7.fhir.core hapifhir | 5.0 | Aug 7 | HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles |
| CVE-2026-49485 | OR org.hl7.fhir.core hapifhir | 7.5 | Jul 17 | HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint |
| CVE-2026-45367 | OR org.hl7.fhir.core hapifhir | 7.5 | Jul 16 | HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint |
| CVE-2026-55471 | OR org.hl7.fhir.core hapifhir | 9.1 | Jul 8 | HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory |
| CVE-2026-55470 | OR org.hl7.fhir.core hapifhir | 7.5 | Jul 8 | HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS |
| CVE-2026-34361 | OR org.hl7.fhir.core hapifhir | 9.3 | Mar 31 | HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft |
| CVE-2026-34360 | OR org.hl7.fhir.core hapifhir | 5.8 | Mar 31 | HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing |
| CVE-2026-34359 | OR org.hl7.fhir.core hapifhir | 9.1 | Mar 31 | HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core |
| CVE-2026-33180 | OR org.hl7.fhir.core hapifhir | 7.5 | Mar 20 | HAPI FHIR HTTP authentication leak in redirects |
| CVE-2024-45294 | OR org.hl7.fhir.core hapifhir | 8.6 | Sep 6 | `org.hl7.fhir.core` XXE vulnerability in XSLT transforms |
| CVE-2023-28465 | HF Hl7 Fhir Core Hapifhir | 7.5 | Dec 12 | The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory… |
| CVE-2023-24057 | HF Hl7 Fhir Core Hapifhir | 8.1 | Jan 26 | HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a… |
| CVE-2020-24301 | TO Testpage Overlay Hapifhir | 6.1 | Oct 8 | Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be… |