Header Exposure Vulnerability in HAPI FHIR by HAPI FHIR

CVE-2026-33180

What is CVE-2026-33180?

HAPI FHIR, an implementation of the HL7 FHIR standard for Java-based healthcare interoperability, has a vulnerability that exposes sensitive HTTP headers. In versions prior to 6.9.0, the internal HTTP client unintentionally forwards headers that may contain private information or authentication tokens when following HTTP redirects. This behavior can lead to unauthorized access or impersonation risks, making it critical for users to upgrade to version 6.9.0 to mitigate these security concerns.

References