CVE-2026-34360: HAPI FHIR SSRF in FHIR Validator /loadIG endpoint

CVE-2026-34360 · Severity: medium · CVSS 5.8 · Published 2026-03-31

HAPI FHIR is a Java-based implementation of the HL7 FHIR standard used for exchanging healthcare data between different systems. A security flaw in its validation service allows an unauthenticated attacker to force the server to make unauthorized network requests to internal systems or cloud metadata services. This could allow an attacker to map out a private corporate network, identify internal services, or gain information about the cloud environment where the application is hosted.

Technologies: Hapifhir Hl7 Fhir Core, ca.uhn.hapi.fhir:org.hl7.fhir.core (Maven). Vendors: Hapifhir, Maven.

Quick answers

Is CVE-2026-34360 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34360 being exploited in the wild.
How severe is CVE-2026-34360?
Medium severity, with a CVSS score of 5.8, published 31 March 2026.
Which products and versions are affected?
ca.uhn.hapi.fhir:org.hl7.fhir.core (Maven) ECOSYSTEM:introduced=0,fixed=6.9.4.
Is there a fix for CVE-2026-34360?
Yes. ca.uhn.hapi.fhir:org.hl7.fhir.core (Maven): upgrade to 6.9.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34360 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-34360?
Check whether you run Hapifhir Hl7 Fhir Core or ca.uhn.hapi.fhir:org.hl7.fhir.core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ca.uhn.hapi.fhir:org.hl7.fhir.core (Maven): upgrade to 6.9.4 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.core to 6.9.4 in your pom.xml or build.gradle

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the /loadIG HTTP endpoint of the HAPI FHIR Validator service. The root cause is a lack of hostname, scheme, or domain validation in the LoadIGHTTPHandler and IgLoader components when processing user-supplied URLs in a JSON body. By default, the application's domain allowlist is empty and defaults to permitting all destinations. Furthermore, the SimpleHTTPClient follows redirects without re-validating the new target against the allowlist. An unauthenticated attacker can exploit this to perform blind SSRF, using error-based information leakage (e.g., connection refused vs. parse errors) to map internal network topology or access cloud metadata endpoints (169.254.169.254). The vulnerability is patched in version 6.9.4.

Affected products

  • hapifhir HAPI FHIR (org.hl7.fhir.core) < 6.9.4

Identifiers

  • CVE-2026-34360
  • GHSA-3ww8-jw56-9f5h

Timeline

  • 2026-03-27: advisory: GitHub Security Advisory published by maintainers
  • 2026-03-31: disclosed: CVE-2026-34360 published to NVD
  • 2026-03-31: patched: Fix released in version 6.9.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.