Read the docs
TI-2026-40028 Aliases CVE-2026-55471GHSA-2f55-g35j-5jmf

HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

Priority HIGH 77CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-611 and the CVSS impact.

Summary

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform(...) overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET restrictions, allowing an attacker who controls or can tamper with transformed XML to trigger XML External Entity injection for local file disclosure and blind XXE or SSRF to arbitrary URLs reachable from the host. This issue is fixed in version 6.9.10.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00569 47th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.hl7.fhir.core (hapifhir): 6.9.10ca.uhn.hapi.fhir:org.hl7.fhir.utilities (Maven): 6.9.10Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hapifhirorg.hl7.fhir.corebefore 6.9.106.9.10Patch availableCNA
—ca.uhn.hapi.fhir:org.hl7.fhir.utilities (Maven)before 6.9.106.9.10Patch availableGHSA-2f55-g35j-5jmf
  • org.hl7.fhir.core Vendorhapifhir Affected before 6.9.10 Fixed in 6.9.10 Patch available CNA
  • ca.uhn.hapi.fhir:org.hl7.fhir.utilities (Maven) Vendor— Affected before 6.9.10 Fixed in 6.9.10 Patch available GHSA-2f55-g35j-5jmf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hapifhir:hl7_fhir_core:*:*:*:*:*:*:*:*before 6.9.10Vulnerablehapifhir
  • cpe:2.3:a:hapifhir:hl7_fhir_core:*:*:*:*:*:*:*:* Versions before 6.9.10 Vulnerable ·hapifhir

Remediation

  • Fix · CNA org.hl7.fhir.core (hapifhir) Fixed in 6.9.10
  • Fix · GHSA-2f55-g35j-5jmf ca.uhn.hapi.fhir:org.hl7.fhir.utilities (Maven) Fixed in 6.9.10 Advisory →

Red Hat 1 advisory

  • RHSA-2026:54776 Released 2026-08-13 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.GA)
    • Red Hat Build of Apache Camel 4.18 for Quarkus 3.33

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33Fixed RHSA-2026:54776
Not affected: 1 product
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55471
  2. 2026-10-03 Alias added: GHSA-2f55-g35j-5jmf

References

Exploit 1

Patch 1

Other 2

  • TI-2026-26647 HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft CVSS 3.1CRITICAL 9.3
  • TI-2026-26645 HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core CVSS 3.1CRITICAL 9.1
  • TI-2026-40027 HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS CVSS 3.1HIGH 7.5
  • TI-2023-09835 HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files… CVSS 3.1HIGH 8.1
  • TI-2023-13005 The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before… CVSS 3.1HIGH 7.5
  • TI-2026-26646 HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing CVSS 3.1MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences