Hapifhir vulnerabilities
We track 15 vulnerabilities in Hapifhir products across 6 products. 15 are rated high or critical, and none are known to be exploited. The most recent was published on September 16, 2026.
Latest Hapifhir vulnerabilities
- 7.5 High severity
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare…
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can enter an infinite loop while processing
- 7.5 High severity
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare…
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker-controlled Smart Healt
- 7.5 High severity
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare…
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between pars
- 7.5 High severity
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare…
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a res
- 7.5 High severity
org.hl7.fhir.core: Uncontrolled Resource Consumption
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the
- 7.5 High severity
org.hl7.fhir.core: Inefficient Regular Expression Complexity
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java re
- 9.1 Critical severity
org.hl7.fhir.core: Improper Restriction of XML External Entity Reference
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform(...) overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl() without ACCES
- 7.5 High severity
org.hl7.fhir.core: Inefficient Regular Expression Complexity
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches() in org.hl7.fhir.dstu2/utils/FHIRPathEng
- 9.3 Critical severity
org.hl7.fhir.core: Files or Directories Accessible to External Parties
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the FHIR Validator HTTP service exposes an unauthenticated "/loadIG" endpoint that makes outbound HTTP requests to attacker-control
- 9.1 Critical severity
org.hl7.fhir.core: Origin Validation Error
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, ManagedWebAccessUtils.getServer() uses String.startsWith() to match request URLs against configured server URLs for authentication
- 7.5 High severity
org.hl7.fhir.core: Exposure of Sensitive Information to an Unauthorized Actor
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.0, when setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if ask
- 8.6 High severity
org.hl7.fhir.core: Improper Restriction of XML External Entity Reference
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( <!DOCTYPE fo
- 8.6 High severity
org.hl7.fhir.core: Improper Restriction of XML External Entity Reference
The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification. Prior to version 6.3.23, XSLT transforms performed by various com
- 7.5 High severity
Hl7 Fhir Core: Improper Limitation of a Pathname to a Restricted Directory
The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a substring of the directory name chosen by th
- 8.1 High severity
Hl7 Fhir Core: Improper Limitation of a Pathname to a Restricted Directory
HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM package, or comparison archive).