- Latest release
- 7.0.5 (Nov 6, 2026): no advisory affects it
- Newest unaffected release
- 7.0.5 (Nov 6, 2026), the latest release
- Advisories
- 5 · 1 critical, 4 high
- Dependents
- 16
- Releases
- 405 since 0.0.1 (Jun 12, 2020)
- Registry
- Maven Central
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-55470Affects 0.0.1 to 6.9.9 (6.9.10 is outside it)
- CVE-2026-33180Affects 0.0.1 to 6.8.2 (6.9.0 is outside it)
- CVE-2024-51132Affects 0.0.1 to 6.3.32 (6.4.0 is outside it)
- CVE-2023-28465Affects 0.0.1 to 5.6.105 (5.6.106 is outside it)
- CVE-2023-24057Affects 0.0.1 to 5.6.91 (5.6.92 is outside it)
Advisories 5
- CVE-2026-55470High 7.5
HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
Affected: fixed in 6.9.10.
Fixed in 6.9.10 (released Jun 12, 2026, 26 days before disclosure).
The latest release, 7.0.5, is not affected.
- CVE-2026-33180High 7.5
HAPI FHIR HTTP authentication leak in redirects
Affected: fixed in 6.9.0.
Fixed in 6.9.0 (released Mar 17, 2026, 3 days before disclosure).
The latest release, 7.0.5, is not affected.
- CVE-2024-51132Critical 9.8
An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute…
Affected: fixed in 6.4.0.
Fixed in 6.4.0 (released Oct 24, 2024, 12 days before disclosure).
The latest release, 7.0.5, is not affected.
- CVE-2023-28465High 7.5
The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to…
Affected: fixed in 5.6.106.
Fixed in 5.6.106 (released Mar 9, 2023, 278 days before disclosure).
The latest release, 7.0.5, is not affected.
- CVE-2023-24057High 8.1
HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal…
Affected: fixed in 5.6.92.
Fixed in 5.6.92 (released Jan 20, 2023, 4 days before disclosure).
The latest release, 7.0.5, is not affected.