# ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven) vulnerabilities

6 known vulnerabilities (6 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 5.0.0 (May 12, 2020): affected by 6 advisories
- Newest unaffected release: Every release is affected by at least one advisory
- Dependents: 0
- Releases: 7 since 4.0.0 (Aug 14, 2019)
- Registry: https://central.sonatype.com/artifact/ca.uhn.hapi.fhir/org.hl7.fhir.validation.cli
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-81876: 4.0.0 to 5.0.0 (through the newest release)
- CVE-2026-81875: 4.0.0 to 5.0.0 (through the newest release)
- CVE-2026-49485: 4.0.0 to 5.0.0 (through the newest release)
- CVE-2026-45367: 4.0.0 to 5.0.0 (through the newest release)
- CVE-2026-55470: 4.0.0 to 5.0.0 (through the newest release)
- CVE-2026-33180: 4.0.0 to 5.0.0 (through the newest release)

## Advisories (6)

### [CVE-2026-81876](https://cve.now/CVE-2026-81876): HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

- Severity: High 7.5
- Published: Sep 16, 2026
- Affected: fixed in 6.9.12.
- No fix released. The advisory names 6.9.12 as the fix, which the registry doesn't have yet. The latest release, 5.0.0, is still affected.

### [CVE-2026-81875](https://cve.now/CVE-2026-81875): HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service

- Severity: High 7.5
- Published: Sep 16, 2026
- Affected: through 5.0.0.
- No fix released. The latest release, 5.0.0, is still affected.

### [CVE-2026-49485](https://cve.now/CVE-2026-49485): HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

- Severity: High 7.5
- Published: Jul 17, 2026
- Affected: from 6.9.5, fixed in 6.9.9; fixed in 6.9.4.2.
- No fix released. The advisory names 6.9.4.2 and 6.9.9 as the fix, which the registry doesn't have yet. The latest release, 5.0.0, is still affected.

### [CVE-2026-45367](https://cve.now/CVE-2026-45367): HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

- Severity: High 7.5
- Published: Jul 16, 2026
- Affected: fixed in 6.9.7.
- No fix released. The advisory names 6.9.7 as the fix, which the registry doesn't have yet. The latest release, 5.0.0, is still affected.

### [CVE-2026-55470](https://cve.now/CVE-2026-55470): HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

- Severity: High 7.5
- Published: Jul 8, 2026
- Affected: fixed in 6.9.10.
- No fix released. The advisory names 6.9.10 as the fix, which the registry doesn't have yet. The latest release, 5.0.0, is still affected.

### [CVE-2026-33180](https://cve.now/CVE-2026-33180): HAPI FHIR HTTP authentication leak in redirects

- Severity: High 7.5
- Published: Mar 20, 2026
- Affected: fixed in 6.9.0.
- No fix released. The advisory names 6.9.0 as the fix, which the registry doesn't have yet. The latest release, 5.0.0, is still affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.