Is CVE-2026-33180 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33180 being exploited in the wild.

How severe is CVE-2026-33180?

High severity, with a CVSS score of 7.5, published 20 March 2026.

Which products and versions are affected?

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (Maven) ECOSYSTEM:introduced=0,fixed=6.9.0; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven) ECOSYSTEM:introduced=0,fixed=6.9.0; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven) ECOSYSTEM:introduced=0,fixed=6.9.0; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven) ECOSYSTEM:introduced=0,fixed=6.9.0; and 9 more.

Is there a fix for CVE-2026-33180?

Yes. ca.uhn.hapi.fhir:org.hl7.fhir.convertors (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.model (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.r4 (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.r4b (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.utilities (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven): upgrade to 6.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33180 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33180?

Check whether you run ca.uhn.hapi.fhir:org.hl7.fhir.convertors (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33180: HAPI FHIR sensitive information leak via HTTP redirects

CVE-2026-33180 · Severity: high · CVSS 7.5 · Published 2026-03-20

HAPI FHIR is a Java-based library used by healthcare organizations to exchange medical data. A security flaw in its web communication component could cause sensitive information, such as login credentials or private patient data, to be sent to unauthorized third-party servers when a web request is redirected. This could allow an attacker to steal authentication tokens and impersonate legitimate users or access private healthcare records.

Quick answers

Is CVE-2026-33180 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33180 being exploited in the wild.
How severe is CVE-2026-33180?: High severity, with a CVSS score of 7.5, published 20 March 2026.
Which products and versions are affected?: ca.uhn.hapi.fhir:org.hl7.fhir.convertors (Maven) ECOSYSTEM:introduced=0,fixed=6.9.0; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven) ECOSYSTEM:introduced=0,fixed=6.9.0; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven) ECOSYSTEM:introduced=0,fixed=6.9.0; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven) ECOSYSTEM:introduced=0,fixed=6.9.0; and 9 more.
Is there a fix for CVE-2026-33180?: Yes. ca.uhn.hapi.fhir:org.hl7.fhir.convertors (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.model (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.r4 (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.r4b (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.utilities (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven): upgrade to 6.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33180 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33180?: Check whether you run ca.uhn.hapi.fhir:org.hl7.fhir.convertors (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (Maven): upgrade to 6.9.0 or later

# set ca.uhn.hapi.fhir:org.hl7.fhir.convertors to 6.9.0 in your pom.xml or build.gradle

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven): upgrade to 6.9.0 or later

# set ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 to 6.9.0 in your pom.xml or build.gradle

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven): upgrade to 6.9.0 or later

# set ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to 6.9.0 in your pom.xml or build.gradle

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven): upgrade to 6.9.0 or later

# set ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to 6.9.0 in your pom.xml or build.gradle

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support (Maven): upgrade to 6.9.0 or later

# set ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support to 6.9.0 in your pom.xml or build.gradle

ca.uhn.hapi.fhir:org.hl7.fhir.model (Maven): upgrade to 6.9.0 or later

# set ca.uhn.hapi.fhir:org.hl7.fhir.model to 6.9.0 in your pom.xml or build.gradle

ca.uhn.hapi.fhir:org.hl7.fhir.r4 (Maven): upgrade to 6.9.0 or later

# set ca.uhn.hapi.fhir:org.hl7.fhir.r4 to 6.9.0 in your pom.xml or build.gradle

ca.uhn.hapi.fhir:org.hl7.fhir.r4b (Maven): upgrade to 6.9.0 or later

# set ca.uhn.hapi.fhir:org.hl7.fhir.r4b to 6.9.0 in your pom.xml or build.gradle

ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven): upgrade to 6.9.0 or later

# set ca.uhn.hapi.fhir:org.hl7.fhir.r5 to 6.9.0 in your pom.xml or build.gradle

ca.uhn.hapi.fhir:org.hl7.fhir.utilities (Maven): upgrade to 6.9.0 or later

# set ca.uhn.hapi.fhir:org.hl7.fhir.utilities to 6.9.0 in your pom.xml or build.gradle

ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven): upgrade to 6.9.0 or later

# set ca.uhn.hapi.fhir:org.hl7.fhir.validation to 6.9.0 in your pom.xml or build.gradle

ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven): upgrade to 6.9.0 or later

# set ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli to 6.9.0 in your pom.xml or build.gradle

Technical details

An information disclosure vulnerability exists in HAPI FHIR's internal HTTP client due to improper header management during redirects. When the client is configured to follow redirects and receives an HTTP 30X response, it retransmits the original request headers—including sensitive authentication or privacy-related headers—to the new host specified in the 'Location' header. This occurs regardless of whether the new host is trusted or resides on a different domain. Attackers could exploit this by inducing a redirect to a malicious server to capture these headers. The issue is addressed in version 6.9.0 by ensuring sensitive headers are not leaked across different origins during redirection.

Affected products

hapifhir HAPI FHIR (org.hl7.fhir.core) < 6.9.0
Red Hat Red Hat Fuse 7 7

Identifiers

CVE-2026-33180
GHSA-p7m9-v2cm-2h7m

Timeline

2026-03-17: advisory: GitHub advisory published by maintainers
2026-03-20: disclosed: CVE published to NVD
2026-03-20: patched: Issue patched in version 6.9.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.