MavenPackage

ca.uhn.hapi.fhir:org.hl7.fhir.validation

10 known vulnerabilities (2 critical, 8 high), with the versions each affects and the releases that fix them.

Latest release: 7.0.5 (Nov 6, 2026): no advisory affects it
Newest unaffected release: 7.0.5 (Nov 6, 2026), the latest release
Advisories: 10 · 2 critical, 8 high

Dependents: 13
Releases: 405 since 0.0.1 (Jun 12, 2020)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-81876
Affects 0.0.1 to 6.9.11 (6.9.12 is outside it)
CVE-2026-81875
Affects 0.0.1 to 6.9.11 (6.9.12 is outside it)
CVE-2026-49485
Affects 0.0.1 to 6.9.4.1 (6.9.4.2 is outside it); 6.9.5 to 6.9.8 (6.9.9 is outside it)
CVE-2026-45367
Affects 0.0.1 to 6.9.6 (6.9.7 is outside it)
CVE-2026-55470
Affects 0.0.1 to 6.9.9 (6.9.10 is outside it)
CVE-2026-34361
Affects 0.0.1 to 6.9.3 (6.9.4 is outside it)
CVE-2026-33180
Affects 0.0.1 to 6.8.2 (6.9.0 is outside it)
CVE-2024-51132
Affects 0.0.1 to 6.3.32 (6.4.0 is outside it)
CVE-2023-28465
Affects 0.0.1 to 5.6.105 (5.6.106 is outside it)
CVE-2023-24057
Affects 0.0.1 to 5.6.91 (5.6.92 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 10

CVE-2026-81876High 7.5
HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
Affected: fixed in 6.9.12.
Fixed in 6.9.12 (released Jul 15, 2026, 63 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2026-81875High 7.5
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
Affected: fixed in 6.9.12.
Fixed in 6.9.12 (released Jul 15, 2026, 63 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2026-49485High 7.5
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Affected: from 6.9.5, fixed in 6.9.9; fixed in 6.9.4.2.
Fixed in 6.9.4.2 (released May 29, 2026, 49 days before disclosure) and 6.9.9 (released May 29, 2026, 49 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2026-45367High 7.5
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Affected: fixed in 6.9.7.
Fixed in 6.9.7 (released Apr 23, 2026, 84 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2026-55470High 7.5
HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
Affected: fixed in 6.9.10.
Fixed in 6.9.10 (released Jun 12, 2026, 26 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2026-34361Critical 9.3
HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
Affected: fixed in 6.9.4.
Fixed in 6.9.4 (released Mar 26, 2026, 5 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2026-33180High 7.5
HAPI FHIR HTTP authentication leak in redirects
Affected: fixed in 6.9.0.
Fixed in 6.9.0 (released Mar 17, 2026, 3 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2024-51132Critical 9.8
An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute…
Affected: fixed in 6.4.0.
Fixed in 6.4.0 (released Oct 24, 2024, 12 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2023-28465High 7.5
The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to…
Affected: fixed in 5.6.106.
Fixed in 5.6.106 (released Mar 9, 2023, 278 days before disclosure).
The latest release, 7.0.5, is not affected.
CVE-2023-24057High 8.1
HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal…
Affected: fixed in 5.6.92.
Fixed in 5.6.92 (released Jan 20, 2023, 4 days before disclosure).
The latest release, 7.0.5, is not affected.