HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
Priority HIGH 72CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches() in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matches(sw) without RegexTimeout protection while replaceMatches() was updated, allowing an unauthenticated attacker to trigger catastrophic regex backtracking and exhaust server CPU. This issue is fixed in version 6.9.10.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0068 52nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.hl7.fhir.core (hapifhir): 6.9.10ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven): 6.9.10+3 more productsRed Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| hapifhir | org.hl7.fhir.core | before 6.9.10 | 6.9.10 | Patch available | CNA |
| — | ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven) | before 6.9.10 | 6.9.10 | Patch available | GHSA-fxj4-p9xp-37v5 |
| — | ca.uhn.hapi.fhir:org.hl7.fhir.convertors (Maven) | before 6.9.10 | 6.9.10 | Patch available | GHSA-fxj4-p9xp-37v5 |
| — | ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven) | before 6.9.10 | 6.9.10 | Patch available | GHSA-fxj4-p9xp-37v5 |
| — | ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven) | before 6.9.10 | 6.9.10 | Patch available | GHSA-fxj4-p9xp-37v5 |
- org.hl7.fhir.core Vendorhapifhir Affected before 6.9.10 Fixed in 6.9.10 Patch available CNA
- ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven) Vendor— Affected before 6.9.10 Fixed in 6.9.10 Patch available GHSA-fxj4-p9xp-37v5
- ca.uhn.hapi.fhir:org.hl7.fhir.convertors (Maven) Vendor— Affected before 6.9.10 Fixed in 6.9.10 Patch available GHSA-fxj4-p9xp-37v5
- ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven) Vendor— Affected before 6.9.10 Fixed in 6.9.10 Patch available GHSA-fxj4-p9xp-37v5
- ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven) Vendor— Affected before 6.9.10 Fixed in 6.9.10 Patch available GHSA-fxj4-p9xp-37v5
Remediation
- Fix · CNA org.hl7.fhir.core (hapifhir) Fixed in 6.9.10
- Fix · GHSA-fxj4-p9xp-37v5 ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven) Fixed in 6.9.10 Advisory →
- Fix · GHSA-fxj4-p9xp-37v5 ca.uhn.hapi.fhir:org.hl7.fhir.convertors (Maven) Fixed in 6.9.10 Advisory →
- Fix · GHSA-fxj4-p9xp-37v5 ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven) Fixed in 6.9.10 Advisory →
- Fix · GHSA-fxj4-p9xp-37v5 ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven) Fixed in 6.9.10 Advisory →
Red Hat 1 advisory
- RHSA-2026:54776 Released 2026-08-13 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.GA)
- Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet |
| Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 | Fixed | RHSA-2026:54776 |
Not affected: 1 product
- Red Hat JBoss Enterprise Application Platform Expansion Pack
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55470
- 2026-10-03 Alias added: GHSA-fxj4-p9xp-37v5
References
Patch 1
More hapifhir Hl7 Fhir Core vulnerabilities
- TI-2026-26647 HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft CVSS 3.1CRITICAL 9.3
- TI-2026-40028 HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory CVSS 4.0HIGH 8.7
- TI-2026-26645 HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core CVSS 3.1CRITICAL 9.1
- TI-2023-09835 HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files… CVSS 3.1HIGH 8.1
- TI-2023-13005 The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before… CVSS 3.1HIGH 7.5
- TI-2026-26646 HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing CVSS 3.1MEDIUM 5.8
Sources
- CVE-2026-55470 · CVE Program
- CVE-2026-55470 · NVD
- FIRST EPSS
- GHSA-fxj4-p9xp-37v5 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-55470 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences