TI-2026-56488 CVE-2026-81876 · GHSA-gq9c-wmrm-5hvr
HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
Priority HIGH 72
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.
Vulnerabilities
18 records
TI-2026-56487 CVE-2026-81875 · GHSA-3w98-rrpr-fprr
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
Priority HIGH 72
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.
TI-2026-44485 CVE-2026-62296
HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service
Priority HIGH 72
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.
TI-2026-44484 CVE-2026-62295
HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service
Priority HIGH 72
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.
TI-2026-44482 CVE-2026-62293
HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles
Priority MEDIUM 56
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.
TI-2026-36635 CVE-2026-49485 · GHSA-7cmj-v6x8-frvv
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Priority MEDIUM 40
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.
TI-2026-33158 CVE-2026-45367 · GHSA-3653-68v6-rq57
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Priority MEDIUM 40
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.
TI-2026-40028 CVE-2026-55471 · GHSA-2f55-g35j-5jmf
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
Priority HIGH 77
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.
TI-2026-40027 CVE-2026-55470 · GHSA-fxj4-p9xp-37v5
HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
Priority HIGH 72
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.
TI-2026-26647 CVE-2026-34361 · GHSA-vr79-8m62-wh98
HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
Priority HIGH 79
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.
TI-2026-26646 CVE-2026-34360 · GHSA-3ww8-jw56-9f5h
HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing
Priority HIGH 65
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.
TI-2026-26645 CVE-2026-34359 · GHSA-fgv2-4q4g-wc35
HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core
Priority HIGH 74
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.
TI-2026-25609 CVE-2026-33180 · GHSA-p7m9-v2cm-2h7m
HAPI FHIR HTTP authentication leak in redirects
Priority LOW 39
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.
TI-2024-34894 CVE-2024-52007 · GHSA-gr3c-q7xf-47vh
XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`
Priority MEDIUM 45
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.
TI-2024-30366 CVE-2024-45294 · GHSA-6cr6-ph3p-f5rf
`org.hl7.fhir.core` XXE vulnerability in XSLT transforms
Priority LOW 39
The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification.
TI-2023-13005 CVE-2023-28465 · GHSA-9654-pr4f-gh6m
The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before…
Priority HIGH 66
The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a subs…
TI-2023-09835 CVE-2023-24057 · GHSA-jqh6-9574-5x22
HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files…
Priority HIGH 70
HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM packa…
TI-2020-14870 CVE-2020-24301 · GHSA-qj2c-3m6w-qr56
Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL…
Priority LOW 29
Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser.