# CVE-2026-33180: HAPI FHIR sensitive information leak via HTTP redirects

Source: https://junglewise.ai/threats/cve-2026-33180-hapi-fhir-sensitive-information-leak-via-http-redirects  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-20. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-33180 · Severity: high · CVSS 7.5 · Published 2026-03-20

HAPI FHIR is a Java-based library used by healthcare organizations to exchange medical data. A security flaw in its web communication component could cause sensitive information, such as login credentials or private patient data, to be sent to unauthorized third-party servers when a web request is redirected. This could allow an attacker to steal authentication tokens and impersonate legitimate users or access private healthcare records.

Technologies: [ca.uhn.hapi.fhir:org.hl7.fhir.convertors (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-convertors), [ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-dstu2), [ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-dstu2016may), [ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-dstu3), [ca.uhn.hapi.fhir:org.hl7.fhir.r4 (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-r4), [ca.uhn.hapi.fhir:org.hl7.fhir.r4b (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-r4b), [ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-r5), [ca.uhn.hapi.fhir:org.hl7.fhir.utilities (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-utilities), [ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-validation), [ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-validation-cli). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-33180 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33180 being exploited in the wild.

**How severe is CVE-2026-33180?** High severity, with a CVSS score of 7.5, published 20 March 2026.

**Which products and versions are affected?** ca.uhn.hapi.fhir:org.hl7.fhir.convertors (Maven) ECOSYSTEM:introduced=0,fixed=6.9.0; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven) ECOSYSTEM:introduced=0,fixed=6.9.0; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven) ECOSYSTEM:introduced=0,fixed=6.9.0; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven) ECOSYSTEM:introduced=0,fixed=6.9.0; and 9 more.

**Is there a fix for CVE-2026-33180?** Yes. ca.uhn.hapi.fhir:org.hl7.fhir.convertors (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.model (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.r4 (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.r4b (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.utilities (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven): upgrade to 6.9.0 or later; ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven): upgrade to 6.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33180 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33180?** Check whether you run ca.uhn.hapi.fhir:org.hl7.fhir.convertors (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ca.uhn.hapi.fhir:org.hl7.fhir.convertors (Maven): upgrade to 6.9.0 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.convertors to 6.9.0 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven): upgrade to 6.9.0 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 to 6.9.0 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven): upgrade to 6.9.0 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to 6.9.0 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven): upgrade to 6.9.0 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to 6.9.0 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support (Maven): upgrade to 6.9.0 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support to 6.9.0 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.model (Maven): upgrade to 6.9.0 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.model to 6.9.0 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.r4 (Maven): upgrade to 6.9.0 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.r4 to 6.9.0 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.r4b (Maven): upgrade to 6.9.0 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.r4b to 6.9.0 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven): upgrade to 6.9.0 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.r5 to 6.9.0 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.utilities (Maven): upgrade to 6.9.0 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.utilities to 6.9.0 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven): upgrade to 6.9.0 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.validation to 6.9.0 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven): upgrade to 6.9.0 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli to 6.9.0 in your pom.xml or build.gradle
  ```


## Technical details

An information disclosure vulnerability exists in HAPI FHIR's internal HTTP client due to improper header management during redirects. When the client is configured to follow redirects and receives an HTTP 30X response, it retransmits the original request headers—including sensitive authentication or privacy-related headers—to the new host specified in the 'Location' header. This occurs regardless of whether the new host is trusted or resides on a different domain. Attackers could exploit this by inducing a redirect to a malicious server to capture these headers. The issue is addressed in version 6.9.0 by ensuring sensitive headers are not leaked across different origins during redirection.

## Affected products

- hapifhir HAPI FHIR (org.hl7.fhir.core) < 6.9.0
- Red Hat Red Hat Fuse 7 7

## Identifiers

- CVE-2026-33180
- GHSA-p7m9-v2cm-2h7m

## Timeline

- 2026-03-17: advisory: GitHub advisory published by maintainers
- 2026-03-20: disclosed: CVE published to NVD
- 2026-03-20: patched: Issue patched in version 6.9.0

## References

- [https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-p7m9-v2cm-2h7m](https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-p7m9-v2cm-2h7m)
- [https://access.redhat.com/security/cve/CVE-2026-33180](https://access.redhat.com/security/cve/CVE-2026-33180)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2449841](https://bugzilla.redhat.com/show_bug.cgi?id=2449841)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33180.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33180.json)

## Related threats

- [HAPI FHIR SHCParser DEFLATE infinite loop denial of service](https://junglewise.ai/threats/cve-2026-81876-hapi-fhir-shcparser-deflate-infinite-loop-denial-of-service)
- [HAPI FHIR SHCParser unbounded DEFLATE decompression denial of service](https://junglewise.ai/threats/cve-2026-81875-hapi-fhir-shcparser-unbounded-deflate-decompression-denial-of)
- [HAPI FHIR ReDoS in FHIRPathEngine](https://junglewise.ai/threats/cve-2026-49485-hapi-fhir-redos-in-fhirpathengine)
- [HAPI FHIR ReDoS in FHIRPathEngine](https://junglewise.ai/threats/cve-2026-45367-hapi-fhir-redos-in-fhirpathengine)
- [HAPI FHIR XXE injection in XsltUtilities saxonTransform](https://junglewise.ai/threats/cve-2026-55471-hapi-fhir-xxe-injection-in-xsltutilities-saxontransform)