CVE-2026-45367: HAPI FHIR ReDoS in FHIRPathEngine

CVE-2026-45367 · Severity: high · CVSS 7.5 · Published 2026-07-16

HAPI FHIR is a Java-based implementation of the HL7 FHIR standard, which is used globally to exchange healthcare and medical data between different systems. A vulnerability in its processing engine allows an attacker to submit specially crafted text patterns that cause the system to consume excessive processing power. This can lead to a complete service outage, preventing healthcare providers from accessing or sharing critical patient information.

Technologies: ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.r4 (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.r4b (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-45367 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45367 being exploited in the wild.
How severe is CVE-2026-45367?
High severity, with a CVSS score of 7.5, published 16 July 2026.
Which products and versions are affected?
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven) <= 6.9.6, ECOSYSTEM:introduced=0,fixed=6.9.7; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven) <= 6.9.6, ECOSYSTEM:introduced=0,fixed=6.9.7; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven) <= 6.9.6, ECOSYSTEM:introduced=0,fixed=6.9.7; ca.uhn.hapi.fhir:org.hl7.fhir.r4 (Maven) <= 6.9.6, ECOSYSTEM:introduced=0,fixed=6.9.7; and 4 more.
Is there a fix for CVE-2026-45367?
Yes. ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven): upgrade to 6.9.7 or later; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven): upgrade to 6.9.7 or later; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven): upgrade to 6.9.7 or later; ca.uhn.hapi.fhir:org.hl7.fhir.r4 (Maven): upgrade to 6.9.7 or later; ca.uhn.hapi.fhir:org.hl7.fhir.r4b (Maven): upgrade to 6.9.7 or later; ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven): upgrade to 6.9.7 or later; ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven): upgrade to 6.9.7 or later; ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven): upgrade to 6.9.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45367 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45367?
Check whether you run ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven): upgrade to 6.9.7 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 to 6.9.7 in your pom.xml or build.gradle
  • ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven): upgrade to 6.9.7 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to 6.9.7 in your pom.xml or build.gradle
  • ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven): upgrade to 6.9.7 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to 6.9.7 in your pom.xml or build.gradle
  • ca.uhn.hapi.fhir:org.hl7.fhir.r4 (Maven): upgrade to 6.9.7 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.r4 to 6.9.7 in your pom.xml or build.gradle
  • ca.uhn.hapi.fhir:org.hl7.fhir.r4b (Maven): upgrade to 6.9.7 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.r4b to 6.9.7 in your pom.xml or build.gradle
  • ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven): upgrade to 6.9.7 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.r5 to 6.9.7 in your pom.xml or build.gradle
  • ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven): upgrade to 6.9.7 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.validation to 6.9.7 in your pom.xml or build.gradle
  • ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven): upgrade to 6.9.7 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli to 6.9.7 in your pom.xml or build.gradle

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the HAPI FHIR core library due to inefficient regular expression complexity (CWE-1333). The FHIRPathEngine implementation fails to enforce timeouts when processing user-supplied regular expressions through the matches(), matchesFull(), and replaceMatches() functions. An unauthenticated remote attacker can exploit this by providing a malicious regex that triggers catastrophic backtracking in the Java regex engine, leading to CPU exhaustion and a denial of service condition. The issue affects multiple FHIR versions (DSTU2 through R5) and has been mitigated in version 6.9.7 by introducing a RegexTimeout utility class that enforces time constraints on evaluation.

Affected products

  • hapifhir org.hl7.fhir.core (HAPI FHIR) < 6.9.7

Identifiers

  • CVE-2026-45367
  • GHSA-3653-68v6-rq57

Timeline

  • 2026-04-23: patched: Version 6.9.7 released with regex time constraints.
  • 2026-07-16: disclosed: CVE-2026-45367 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.