# CVE-2026-45367: HAPI FHIR ReDoS in FHIRPathEngine

Source: https://junglewise.ai/threats/cve-2026-45367-hapi-fhir-redos-in-fhirpathengine  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-45367 · Severity: high · CVSS 7.5 · Published 2026-07-16

HAPI FHIR is a Java-based implementation of the HL7 FHIR standard, which is used globally to exchange healthcare and medical data between different systems. A vulnerability in its processing engine allows an attacker to submit specially crafted text patterns that cause the system to consume excessive processing power. This can lead to a complete service outage, preventing healthcare providers from accessing or sharing critical patient information.

Technologies: [ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-dstu2), [ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-dstu2016may), [ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-dstu3), [ca.uhn.hapi.fhir:org.hl7.fhir.r4 (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-r4), [ca.uhn.hapi.fhir:org.hl7.fhir.r4b (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-r4b), [ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-r5), [ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-validation), [ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-validation-cli). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-45367 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45367 being exploited in the wild.

**How severe is CVE-2026-45367?** High severity, with a CVSS score of 7.5, published 16 July 2026.

**Which products and versions are affected?** ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven) <= 6.9.6, ECOSYSTEM:introduced=0,fixed=6.9.7; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven) <= 6.9.6, ECOSYSTEM:introduced=0,fixed=6.9.7; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven) <= 6.9.6, ECOSYSTEM:introduced=0,fixed=6.9.7; ca.uhn.hapi.fhir:org.hl7.fhir.r4 (Maven) <= 6.9.6, ECOSYSTEM:introduced=0,fixed=6.9.7; and 4 more.

**Is there a fix for CVE-2026-45367?** Yes. ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven): upgrade to 6.9.7 or later; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven): upgrade to 6.9.7 or later; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven): upgrade to 6.9.7 or later; ca.uhn.hapi.fhir:org.hl7.fhir.r4 (Maven): upgrade to 6.9.7 or later; ca.uhn.hapi.fhir:org.hl7.fhir.r4b (Maven): upgrade to 6.9.7 or later; ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven): upgrade to 6.9.7 or later; ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven): upgrade to 6.9.7 or later; ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven): upgrade to 6.9.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45367 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45367?** Check whether you run ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven): upgrade to 6.9.7 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 to 6.9.7 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven): upgrade to 6.9.7 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to 6.9.7 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven): upgrade to 6.9.7 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to 6.9.7 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.r4 (Maven): upgrade to 6.9.7 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.r4 to 6.9.7 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.r4b (Maven): upgrade to 6.9.7 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.r4b to 6.9.7 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven): upgrade to 6.9.7 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.r5 to 6.9.7 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven): upgrade to 6.9.7 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.validation to 6.9.7 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven): upgrade to 6.9.7 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli to 6.9.7 in your pom.xml or build.gradle
  ```


## Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the HAPI FHIR core library due to inefficient regular expression complexity (CWE-1333). The FHIRPathEngine implementation fails to enforce timeouts when processing user-supplied regular expressions through the matches(), matchesFull(), and replaceMatches() functions. An unauthenticated remote attacker can exploit this by providing a malicious regex that triggers catastrophic backtracking in the Java regex engine, leading to CPU exhaustion and a denial of service condition. The issue affects multiple FHIR versions (DSTU2 through R5) and has been mitigated in version 6.9.7 by introducing a RegexTimeout utility class that enforces time constraints on evaluation.

## Affected products

- hapifhir org.hl7.fhir.core (HAPI FHIR) < 6.9.7

## Identifiers

- CVE-2026-45367
- GHSA-3653-68v6-rq57

## Timeline

- 2026-04-23: patched: Version 6.9.7 released with regex time constraints.
- 2026-07-16: disclosed: CVE-2026-45367 published.

## References

- [https://github.com/hapifhir/org.hl7.fhir.core/commit/275d015c680ce9f90cbe285596e50118e472bf24](https://github.com/hapifhir/org.hl7.fhir.core/commit/275d015c680ce9f90cbe285596e50118e472bf24)
- [https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed](https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed)
- [https://github.com/hapifhir/org.hl7.fhir.core/pull/2403](https://github.com/hapifhir/org.hl7.fhir.core/pull/2403)
- [https://github.com/hapifhir/org.hl7.fhir.core/pull/2463](https://github.com/hapifhir/org.hl7.fhir.core/pull/2463)
- [https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.7](https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.7)
- [https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3653-68v6-rq57](https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3653-68v6-rq57)

## Related threats

- [HAPI FHIR SHCParser DEFLATE infinite loop denial of service](https://junglewise.ai/threats/cve-2026-81876-hapi-fhir-shcparser-deflate-infinite-loop-denial-of-service)
- [HAPI FHIR SHCParser unbounded DEFLATE decompression denial of service](https://junglewise.ai/threats/cve-2026-81875-hapi-fhir-shcparser-unbounded-deflate-decompression-denial-of)
- [HAPI FHIR ReDoS in FHIRPathEngine](https://junglewise.ai/threats/cve-2026-49485-hapi-fhir-redos-in-fhirpathengine)
- [HAPI FHIR ReDoS in DSTU2 FHIRPathEngine](https://junglewise.ai/threats/cve-2026-55470-hapi-fhir-redos-in-dstu2-fhirpathengine)
- [HAPI FHIR SSRF and credential leak in FHIR Validator](https://junglewise.ai/threats/cve-2026-34361-hapi-fhir-ssrf-and-credential-leak-in-fhir-validator)