MavenPackage

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2

5 known vulnerabilities (1 critical, 4 high), with the versions each affects and the releases that fix them.

Version timeline

CVE-2026-49485
Affects 0.0.1 to 6.9.4.1 (6.9.4.2 is outside it); 6.9.5 to 6.9.8 (6.9.9 is outside it)
CVE-2026-45367
Affects 0.0.1 to 6.9.6 (6.9.7 is outside it)
CVE-2026-55470
Affects 0.0.1 to 6.9.9 (6.9.10 is outside it)
CVE-2026-33180
Affects 0.0.1 to 6.8.2 (6.9.0 is outside it)
CVE-2024-51132
Affects 0.0.1 to 6.3.32 (6.4.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-49485High 7.5
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Affected: from 6.9.5, fixed in 6.9.9; fixed in 6.9.4.2.
Fixed in 6.9.4.2 (released May 29, 2026, 49 days before disclosure) and 6.9.9 (released May 29, 2026, 49 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2026-45367High 7.5
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Affected: fixed in 6.9.7.
Fixed in 6.9.7 (released Apr 23, 2026, 84 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2026-55470High 7.5
HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
Affected: fixed in 6.9.10.
Fixed in 6.9.10 (released Jun 12, 2026, 26 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2026-33180High 7.5
HAPI FHIR HTTP authentication leak in redirects
Affected: fixed in 6.9.0.
Fixed in 6.9.0 (released Mar 17, 2026, 3 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2024-51132Critical 9.8
An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute…
Affected: fixed in 6.4.0.
Fixed in 6.4.0 (released Oct 24, 2024, 12 days before disclosure).
The latest release, 7.0.5, is not affected.