CVE CVE-2026-45367

CVE-2026-45367

Express

Severity: HIGH
CVSS: 7.5CVSS
Published: 2026-07-16
Last modified: 2026-07-16
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-1333

Description

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.

References

https://github.com/hapifhir/org.hl7.fhir.core/commit/275d015c680ce9f90cbe285596e50118e472bf24
https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed
https://github.com/hapifhir/org.hl7.fhir.core/pull/2403
https://github.com/hapifhir/org.hl7.fhir.core/pull/2463
https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.7
https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3653-68v6-rq57

Summary

Description

References