# ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven) vulnerabilities 10 known vulnerabilities (2 critical, 8 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 7.0.5 (Nov 6, 2026): no advisory affects it - Newest unaffected release: 7.0.5 (Nov 6, 2026), the latest release - Dependents: 13 - Releases: 405 since 0.0.1 (Jun 12, 2020) - Registry: https://central.sonatype.com/artifact/ca.uhn.hapi.fhir/org.hl7.fhir.validation - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-81876: 0.0.1 to 6.9.11 (6.9.12 is outside it) - CVE-2026-81875: 0.0.1 to 6.9.11 (6.9.12 is outside it) - CVE-2026-49485: 0.0.1 to 6.9.4.1 (6.9.4.2 is outside it); 6.9.5 to 6.9.8 (6.9.9 is outside it) - CVE-2026-45367: 0.0.1 to 6.9.6 (6.9.7 is outside it) - CVE-2026-55470: 0.0.1 to 6.9.9 (6.9.10 is outside it) - CVE-2026-34361: 0.0.1 to 6.9.3 (6.9.4 is outside it) - CVE-2026-33180: 0.0.1 to 6.8.2 (6.9.0 is outside it) - CVE-2024-51132: 0.0.1 to 6.3.32 (6.4.0 is outside it) - CVE-2023-28465: 0.0.1 to 5.6.105 (5.6.106 is outside it) - CVE-2023-24057: 0.0.1 to 5.6.91 (5.6.92 is outside it) ## Advisories (10) ### [CVE-2026-81876](https://cve.now/CVE-2026-81876): HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service - Severity: High 7.5 - Published: Sep 16, 2026 - Affected: fixed in 6.9.12. - Fixed in 6.9.12 (released Jul 15, 2026, 63 days before disclosure). - The latest release, 7.0.5, is not affected. ### [CVE-2026-81875](https://cve.now/CVE-2026-81875): HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service - Severity: High 7.5 - Published: Sep 16, 2026 - Affected: fixed in 6.9.12. - Fixed in 6.9.12 (released Jul 15, 2026, 63 days before disclosure). - The latest release, 7.0.5, is not affected. ### [CVE-2026-49485](https://cve.now/CVE-2026-49485): HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint - Severity: High 7.5 - Published: Jul 17, 2026 - Affected: from 6.9.5, fixed in 6.9.9; fixed in 6.9.4.2. - Fixed in 6.9.4.2 (released May 29, 2026, 49 days before disclosure) and 6.9.9 (released May 29, 2026, 49 days before disclosure). - The latest release, 7.0.5, is not affected. ### [CVE-2026-45367](https://cve.now/CVE-2026-45367): HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint - Severity: High 7.5 - Published: Jul 16, 2026 - Affected: fixed in 6.9.7. - Fixed in 6.9.7 (released Apr 23, 2026, 84 days before disclosure). - The latest release, 7.0.5, is not affected. ### [CVE-2026-55470](https://cve.now/CVE-2026-55470): HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS - Severity: High 7.5 - Published: Jul 8, 2026 - Affected: fixed in 6.9.10. - Fixed in 6.9.10 (released Jun 12, 2026, 26 days before disclosure). - The latest release, 7.0.5, is not affected. ### [CVE-2026-34361](https://cve.now/CVE-2026-34361): HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft - Severity: Critical 9.3 - Published: Mar 31, 2026 - Affected: fixed in 6.9.4. - Fixed in 6.9.4 (released Mar 26, 2026, 5 days before disclosure). - The latest release, 7.0.5, is not affected. ### [CVE-2026-33180](https://cve.now/CVE-2026-33180): HAPI FHIR HTTP authentication leak in redirects - Severity: High 7.5 - Published: Mar 20, 2026 - Affected: fixed in 6.9.0. - Fixed in 6.9.0 (released Mar 17, 2026, 3 days before disclosure). - The latest release, 7.0.5, is not affected. ### [CVE-2024-51132](https://cve.now/CVE-2024-51132): An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute… - Severity: Critical 9.8 - Published: Nov 5, 2024 - Affected: fixed in 6.4.0. - Fixed in 6.4.0 (released Oct 24, 2024, 12 days before disclosure). - The latest release, 7.0.5, is not affected. ### [CVE-2023-28465](https://cve.now/CVE-2023-28465): The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to… - Severity: High 7.5 - Published: Dec 12, 2023 - Affected: fixed in 5.6.106. - Fixed in 5.6.106 (released Mar 9, 2023, 278 days before disclosure). - The latest release, 7.0.5, is not affected. ### [CVE-2023-24057](https://cve.now/CVE-2023-24057): HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal… - Severity: High 8.1 - Published: Jan 24, 2023 - Affected: fixed in 5.6.92. - Fixed in 5.6.92 (released Jan 20, 2023, 4 days before disclosure). - The latest release, 7.0.5, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/ca.uhn.hapi.fhir:org.hl7.fhir.validation Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.