Vulnerabilities

TI-2026-40028 CVE-2026-55471 · GHSA-2f55-g35j-5jmf

HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

HIGH 77

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00569 Published 2026-07-08 Partial fix · 6.9.10 CWE-611

TI-2026-40027 CVE-2026-55470 · GHSA-fxj4-p9xp-37v5

HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

HIGH 72

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0068 Published 2026-07-08 Partial fix · 6.9.10 CWE-1333

TI-2026-26647 CVE-2026-34361 · GHSA-vr79-8m62-wh98

HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft

HIGH 79

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00305 Published 2026-03-31 Fixed in 6.9.4 CWE-552

TI-2026-26646 CVE-2026-34360 · GHSA-3ww8-jw56-9f5h

HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing

HIGH 65

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00244 Published 2026-03-31 Fixed in 6.9.4 CWE-918

TI-2026-26645 CVE-2026-34359 · GHSA-fgv2-4q4g-wc35

HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core

HIGH 74

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00164 Published 2026-03-31 Fixed in 6.9.4 CWE-346

TI-2023-13005 CVE-2023-28465 · GHSA-9654-pr4f-gh6m

The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before…

HIGH 66

The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a subs…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.013 Published 2023-12-12 Fixed in 5.6.106 CWE-22

TI-2023-09835 CVE-2023-24057 · GHSA-jqh6-9574-5x22

HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files…

HIGH 70

HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM packa…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01179 Published 2023-01-24 Fixed in 5.6.92 CWE-22

Vulnerabilities

Filters

HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft

HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing

HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core

The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before…

HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files…