MavenPackage

ca.uhn.hapi.fhir:org.hl7.fhir.r5

10 known vulnerabilities (1 critical, 9 high), with the versions each affects and the releases that fix them.

Latest release: 7.0.5 (Nov 6, 2026): no advisory affects it
Newest unaffected release: 7.0.5 (Nov 6, 2026), the latest release
Advisories: 10 · 1 critical, 9 high

Dependents: 21
Releases: 405 since 0.0.1 (Jun 12, 2020)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-81876
Affects 0.0.1 to 6.9.11 (6.9.12 is outside it)
CVE-2026-81875
Affects 0.0.1 to 6.9.11 (6.9.12 is outside it)
CVE-2026-49485
Affects 0.0.1 to 6.9.4.1 (6.9.4.2 is outside it); 6.9.5 to 6.9.8 (6.9.9 is outside it)
CVE-2026-45367
Affects 0.0.1 to 6.9.6 (6.9.7 is outside it)
CVE-2026-33180
Affects 0.0.1 to 6.8.2 (6.9.0 is outside it)
CVE-2024-52007
Affects 0.0.1 to 6.3.32 (6.4.0 is outside it)
CVE-2024-51132
Affects 0.0.1 to 6.3.32 (6.4.0 is outside it)
CVE-2024-45294
Affects 0.0.1 to 6.3.22 (6.3.23 is outside it)
CVE-2023-28465
Affects 0.0.1 to 5.6.105 (5.6.106 is outside it)
CVE-2023-24057
Affects 0.0.1 to 5.6.91 (5.6.92 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 10

CVE-2026-81876High 7.5
HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
Affected: fixed in 6.9.12.
Fixed in 6.9.12 (released Jul 15, 2026, 63 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2026-81875High 7.5
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
Affected: fixed in 6.9.12.
Fixed in 6.9.12 (released Jul 15, 2026, 63 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2026-49485High 7.5
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Affected: from 6.9.5, fixed in 6.9.9; fixed in 6.9.4.2.
Fixed in 6.9.4.2 (released May 29, 2026, 49 days before disclosure) and 6.9.9 (released May 29, 2026, 49 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2026-45367High 7.5
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Affected: fixed in 6.9.7.
Fixed in 6.9.7 (released Apr 23, 2026, 84 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2026-33180High 7.5
HAPI FHIR HTTP authentication leak in redirects
Affected: fixed in 6.9.0.
Fixed in 6.9.0 (released Mar 17, 2026, 3 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2024-52007High 8.6
XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`
Affected: fixed in 6.4.0.
Fixed in 6.4.0 (released Oct 24, 2024, 15 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2024-51132Critical 9.8
An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute…
Affected: fixed in 6.4.0.
Fixed in 6.4.0 (released Oct 24, 2024, 12 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2024-45294High 8.6
`org.hl7.fhir.core` XXE vulnerability in XSLT transforms
Affected: fixed in 6.3.23.
Fixed in 6.3.23 (released Aug 28, 2024, 9 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2023-28465High 7.5
The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to…
Affected: fixed in 5.6.106.
Fixed in 5.6.106 (released Mar 9, 2023, 278 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2023-24057High 8.1
HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal…
Affected: fixed in 5.6.92.
Fixed in 5.6.92 (released Jan 20, 2023, 4 days before disclosure).
The latest release, 7.0.5, is not affected.