Junglewise Threat Intelligence

CVE-2026-49485: HAPI FHIR ReDoS in FHIRPathEngine

CVE-2026-49485 · Severity: high · CVSS 7.5 · Published 2026-07-17

Vendors: Hapifhir.

Executive brief

HAPI FHIR is a Java-based library used by healthcare organizations to exchange and validate medical data. A vulnerability in its data processing engine allows an attacker to send specially crafted data that triggers a 'Regular Expression Denial of Service' (ReDoS). This can cause the system to consume all available processor power, leading to a complete service outage and preventing healthcare providers from exchanging critical patient information.

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the FHIRPathEngine of HAPI FHIR. The engine accepts arbitrary FHIRPath expressions and evaluates functions such as matches(), matchesFull(), and replaceMatches() using user-controlled regular expressions. These expressions are passed to Java's Pattern.compile() and String.replaceAll() through a timeout utility that fails to properly terminate the execution thread upon timeout. An attacker can exploit this by submitting a resource with a 'catastrophic backtracking' regex pattern, leading to 100% CPU exhaustion. The issue affects multiple modules including org.hl7.fhir.r4, r4b, and r5, and is fixed in versions 6.9.9 and 6.9.4.2.

Affected products

  • hapifhir org.hl7.fhir.core < 6.9.4.2, >= 6.9.5 < 6.9.9

Timeline

  • 2026-05-29: patched: Fixes merged and releases 6.9.4.2 and 6.9.9 created.
  • 2026-06-01: advisory: GitHub Security Advisory GHSA-7cmj-v6x8-frvv published.
  • 2026-07-17: disclosed: CVE-2026-49485 published to NVD.

References