Denial of Service Vulnerability in HAPI FHIR Healthcare Interoperability Implementation

CVE-2026-45367

What is CVE-2026-45367?

HAPI FHIR is a comprehensive implementation of the HL7 FHIR standard for healthcare interoperability built in Java. Prior to version 6.9.7, the FHIRPathEngine had a major vulnerability that allowed user-controlled regular expressions used in the methods matches(), matchesFull(), and replaceMatches() to be executed without appropriate timeouts. This oversight led to potential catastrophic backtracking scenarios, which could be exploited to create a denial of service condition in applications relying on this library. To mitigate this vulnerability, users are advised to update to version 6.9.7 or later.

References