Executive brief
HAPI FHIR is a Java-based implementation of the HL7 FHIR standard, which is used globally to exchange healthcare and medical data between different systems. A vulnerability in its processing engine allows an attacker to submit specially crafted text patterns that cause the system to consume excessive processing power. This can lead to a complete service outage, preventing healthcare providers from accessing or sharing critical patient information.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the HAPI FHIR core library due to inefficient regular expression complexity (CWE-1333). The FHIRPathEngine implementation fails to enforce timeouts when processing user-supplied regular expressions through the matches(), matchesFull(), and replaceMatches() functions. An unauthenticated remote attacker can exploit this by providing a malicious regex that triggers catastrophic backtracking in the Java regex engine, leading to CPU exhaustion and a denial of service condition. The issue affects multiple FHIR versions (DSTU2 through R5) and has been mitigated in version 6.9.7 by introducing a RegexTimeout utility class that enforces time constraints on evaluation.
Affected products
- hapifhir org.hl7.fhir.core (HAPI FHIR) < 6.9.7
Timeline
- 2026-04-23: patched: Version 6.9.7 released with regex time constraints.
- 2026-07-16: disclosed: CVE-2026-45367 published.
References
- https://github.com/hapifhir/org.hl7.fhir.core/commit/275d015c680ce9f90cbe285596e50118e472bf24
- https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed
- https://github.com/hapifhir/org.hl7.fhir.core/pull/2403
- https://github.com/hapifhir/org.hl7.fhir.core/pull/2463
- https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.7
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3653-68v6-rq57