hapifhir

Records18All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high13CVSS 7.0–8.9

Exploited now

hapifhir records in CISA KEV

No hapifhir vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Hl7 Fhir Core 7 records HIGH Testpage Overlay 1 record LOW

Records

18 records

TI-2026-26647 CVE-2026-34361 · GHSA-vr79-8m62-wh98

HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft

HIGH 79

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00305 Published 2026-03-31 Fixed in 6.9.4 CWE-552

TI-2026-40028 CVE-2026-55471 · GHSA-2f55-g35j-5jmf

HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

HIGH 77

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00569 Published 2026-07-08 Partial fix · 6.9.10 CWE-611

TI-2026-26645 CVE-2026-34359 · GHSA-fgv2-4q4g-wc35

HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core

HIGH 74

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00164 Published 2026-03-31 Fixed in 6.9.4 CWE-346

TI-2026-56488 CVE-2026-81876 · GHSA-gq9c-wmrm-5hvr

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

HIGH 72

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-09-16 Fixed in 6.9.12 CWE-20

TI-2026-56487 CVE-2026-81875 · GHSA-3w98-rrpr-fprr

HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service

HIGH 72

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-09-16 Fixed in 6.9.12 CWE-20

TI-2026-44485 CVE-2026-62296

HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service

HIGH 72

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00488 Published 2026-08-07 Partial fix · 6.9.11 CWE-20

TI-2026-44484 CVE-2026-62295

HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service

HIGH 72

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00488 Published 2026-08-07 Fixed in 6.9.11 CWE-20

TI-2026-40027 CVE-2026-55470 · GHSA-fxj4-p9xp-37v5

HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

HIGH 72

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0068 Published 2026-07-08 Partial fix · 6.9.10 CWE-1333

TI-2023-09835 CVE-2023-24057 · GHSA-jqh6-9574-5x22

HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files…

HIGH 70

HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM packa…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01179 Published 2023-01-24 Fixed in 5.6.92 CWE-22

TI-2023-13005 CVE-2023-28465 · GHSA-9654-pr4f-gh6m

The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before…

HIGH 66

The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a subs…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.013 Published 2023-12-12 Fixed in 5.6.106 CWE-22

TI-2026-26646 CVE-2026-34360 · GHSA-3ww8-jw56-9f5h

HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing

HIGH 65

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00244 Published 2026-03-31 Fixed in 6.9.4 CWE-918

TI-2026-44482 CVE-2026-62293

HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles

MEDIUM 56

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1MEDIUM 5.0 Local No auth User interaction EPSS 0.00167 Published 2026-08-07 Fixed in 6.9.11 CWE-20

TI-2024-34894 CVE-2024-52007 · GHSA-gr3c-q7xf-47vh

XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

MEDIUM 45

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00899 Published 2024-11-08 Partial fix · 6.4.0 CWE-611

TI-2026-36635 CVE-2026-49485 · GHSA-7cmj-v6x8-frvv

HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

MEDIUM 40

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00684 Published 2026-07-17 Partial fix · 6.9.4.2, 6.9.9 CWE-1333

TI-2026-33158 CVE-2026-45367 · GHSA-3653-68v6-rq57

HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

MEDIUM 40

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00684 Published 2026-07-16 Partial fix · 6.9.7 CWE-1333

TI-2026-25609 CVE-2026-33180 · GHSA-p7m9-v2cm-2h7m

HAPI FHIR HTTP authentication leak in redirects

LOW 39

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00281 Published 2026-03-20 Partial fix · 6.9.0 CWE-200

TI-2024-30366 CVE-2024-45294 · GHSA-6cr6-ph3p-f5rf

`org.hl7.fhir.core` XXE vulnerability in XSLT transforms

LOW 39

The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00975 Published 2024-09-06 Partial fix · 6.3.23 CWE-611

TI-2020-14870 CVE-2020-24301 · GHSA-qj2c-3m6w-qr56

Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL…

LOW 29

Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00947 Published 2020-10-08 No fix listed CWE-79

Open these records in search →

Critical	2
High	13
Medium	3
Low	0
No CVSS	0