{"id":"CVE-2026-45367","published":"2026-07-16T16:52:04Z","modified":"2026-07-18T03:00:14Z","title":"HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint","vendor":"hapifhir","product":"org.hl7.fhir.core","tier":"tail","description":{"text":"HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00684,"percentile":0.52437,"provenance":"source"},"cwes":[{"id":"CWE-1333","name":"Inefficient Regular Expression Complexity"}],"references":[{"url":"https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3653-68v6-rq57","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/hapifhir/org.hl7.fhir.core/pull/2403","tags":["x_refsource_MISC"]},{"url":"https://github.com/hapifhir/org.hl7.fhir.core/pull/2463","tags":["x_refsource_MISC"]},{"url":"https://github.com/hapifhir/org.hl7.fhir.core/commit/275d015c680ce9f90cbe285596e50118e472bf24","tags":["x_refsource_MISC"]},{"url":"https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed","tags":["x_refsource_MISC"]},{"url":"https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.7","tags":["x_refsource_MISC"]}],"priority":{"score":15.7,"factors":[{"name":"EPSS percentile","points":10.49},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"hapifhir","affectedVersions":[{"vendor":"hapifhir","product":"org.hl7.fhir.core","versions":["< 6.9.7"]}],"affected":[{"ecosystem":"Maven","package":"ca.uhn.hapi.fhir:org.hl7.fhir.dstu2","vulnerableRanges":["<6.9.7"],"patched":["6.9.7"],"from":["GHSA-3653-68v6-rq57"],"provenance":"source"},{"ecosystem":"Maven","package":"ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may","vulnerableRanges":["<6.9.7"],"patched":["6.9.7"],"from":["GHSA-3653-68v6-rq57"],"provenance":"source"},{"ecosystem":"Maven","package":"ca.uhn.hapi.fhir:org.hl7.fhir.dstu3","vulnerableRanges":["<6.9.7"],"patched":["6.9.7"],"from":["GHSA-3653-68v6-rq57"],"provenance":"source"},{"ecosystem":"Maven","package":"ca.uhn.hapi.fhir:org.hl7.fhir.r4","vulnerableRanges":["<6.9.7"],"patched":["6.9.7"],"from":["GHSA-3653-68v6-rq57"],"provenance":"source"},{"ecosystem":"Maven","package":"ca.uhn.hapi.fhir:org.hl7.fhir.r4b","vulnerableRanges":["<6.9.7"],"patched":["6.9.7"],"from":["GHSA-3653-68v6-rq57"],"provenance":"source"},{"ecosystem":"Maven","package":"ca.uhn.hapi.fhir:org.hl7.fhir.r5","vulnerableRanges":["<6.9.7"],"patched":["6.9.7"],"from":["GHSA-3653-68v6-rq57"],"provenance":"source"},{"ecosystem":"Maven","package":"ca.uhn.hapi.fhir:org.hl7.fhir.validation","vulnerableRanges":["<6.9.7"],"patched":["6.9.7"],"from":["GHSA-3653-68v6-rq57"],"provenance":"source"},{"ecosystem":"Maven","package":"ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli","vulnerableRanges":["<6.9.7"],"patched":["6.9.7"],"from":["GHSA-3653-68v6-rq57"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-44983","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-hapifhir-org-hl7-fhir-core-cve-2026-55470","children":[{"from":"CVE-2026-45367","to":"CVE-2026-55470","relation":"incomplete-fix","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches() in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matches(sw) without RegexTimeout protection while repla…","from":"CVE.org","in":"CVE-2026-55470"},{"kind":"similar","provenance":"machine","score":0.49,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2024-51132","published":"2024-11-05","fixed":"6.4.0","kev":false},{"cve":"CVE-2026-33180","published":"2026-03-20","fixed":"6.9.0","kev":false},{"cve":"CVE-2026-45367","published":"2026-07-16","fixed":"6.9.7","kev":false},{"cve":"CVE-2026-49485","published":"2026-07-17","fixed":"6.9.9","kev":false,"link":{"from":"CVE-2026-49485","to":"CVE-2026-45367","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:ca.uhn.hapi.fhir:org.hl7.fhir.dstu2","fromFixed":"6.9.4.2","toFixed":"6.9.7","daysApart":-1},{"kind":"version-step","provenance":"source","package":"Maven:ca.uhn.hapi.fhir:org.hl7.fhir.dstu2","fromFixed":"6.9.7","toFixed":"6.9.9","daysApart":1},{"kind":"similar","provenance":"machine","score":0.53,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2026-55470","published":"2026-07-08","fixed":"6.9.10","kev":false}],"package":"Maven:ca.uhn.hapi.fhir:org.hl7.fhir.dstu2"}}