- Latest release
- 7.0.5 (Nov 6, 2026): no advisory affects it
- Newest unaffected release
- 7.0.5 (Nov 6, 2026), the latest release
- Advisories
- 4 · 3 high, 1 medium
- Dependents
- 0
- Releases
- 405 since 0.0.1 (Jun 12, 2020)
- Registry
- Maven Central
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-34360Affects 0.0.1 to 6.9.3 (6.9.4 is outside it)
- CVE-2026-34359Affects 0.0.1 to 6.9.3 (6.9.4 is outside it)
- CVE-2023-28465Affects 0.0.1 to 5.6.105 (5.6.106 is outside it)
- CVE-2023-24057Affects 0.0.1 to 5.6.91 (5.6.92 is outside it)
Advisories 4
- CVE-2026-34360Medium 5.8
HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing
Affected: fixed in 6.9.4.
Fixed in 6.9.4 (released Mar 26, 2026, 5 days before disclosure).
The latest release, 7.0.5, is not affected.
- CVE-2026-34359High 7.4
HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core
Affected: fixed in 6.9.4.
Fixed in 6.9.4 (released Mar 26, 2026, 5 days before disclosure).
The latest release, 7.0.5, is not affected.
- CVE-2023-28465High 7.5
The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to…
Affected: fixed in 5.6.106.
Fixed in 5.6.106 (released Mar 9, 2023, 278 days before disclosure).
The latest release, 7.0.5, is not affected.
- CVE-2023-24057High 8.1
HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal…
Affected: fixed in 5.6.92.
Fixed in 5.6.92 (released Jan 20, 2023, 4 days before disclosure).
The latest release, 7.0.5, is not affected.