CVE-2026-49485: HAPI FHIR ReDoS in FHIRPathEngine

CVE-2026-49485 · Severity: high · CVSS 7.5 · Published 2026-07-17

HAPI FHIR is a Java-based library used by healthcare organizations to exchange and validate medical data. A vulnerability in its data processing engine allows an attacker to send specially crafted data that triggers a 'Regular Expression Denial of Service' (ReDoS). This can cause the system to consume all available processor power, leading to a complete service outage and preventing healthcare providers from exchanging critical patient information.

Technologies: ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.r4 (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.r4b (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-49485 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49485 being exploited in the wild.
How severe is CVE-2026-49485?
High severity, with a CVSS score of 7.5, published 17 July 2026.
Which products and versions are affected?
HL7 International FHIR Core < 6.9.4.2, >= 6.9.5, < 6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven) ECOSYSTEM:introduced=6.9.5,fixed=6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven) ECOSYSTEM:introduced=6.9.5,fixed=6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven) ECOSYSTEM:introduced=6.9.5,fixed=6.9.9; and 5 more.
Is there a fix for CVE-2026-49485?
Yes. ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven): upgrade to 6.9.9 or later; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven): upgrade to 6.9.9 or later; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven): upgrade to 6.9.9 or later; ca.uhn.hapi.fhir:org.hl7.fhir.r4 (Maven): upgrade to 6.9.9 or later; ca.uhn.hapi.fhir:org.hl7.fhir.r4b (Maven): upgrade to 6.9.9 or later; ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven): upgrade to 6.9.9 or later; ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven): upgrade to 6.9.9 or later; ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven): upgrade to 6.9.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49485 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-49485?
Check whether you run HL7 International FHIR Core, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (Maven): upgrade to 6.9.9 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 to 6.9.9 in your pom.xml or build.gradle
  • ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (Maven): upgrade to 6.9.9 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to 6.9.9 in your pom.xml or build.gradle
  • ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (Maven): upgrade to 6.9.9 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to 6.9.9 in your pom.xml or build.gradle
  • ca.uhn.hapi.fhir:org.hl7.fhir.r4 (Maven): upgrade to 6.9.9 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.r4 to 6.9.9 in your pom.xml or build.gradle
  • ca.uhn.hapi.fhir:org.hl7.fhir.r4b (Maven): upgrade to 6.9.9 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.r4b to 6.9.9 in your pom.xml or build.gradle
  • ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven): upgrade to 6.9.9 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.r5 to 6.9.9 in your pom.xml or build.gradle
  • ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven): upgrade to 6.9.9 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.validation to 6.9.9 in your pom.xml or build.gradle
  • ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven): upgrade to 6.9.9 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli to 6.9.9 in your pom.xml or build.gradle

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the FHIRPathEngine of HAPI FHIR. The engine accepts arbitrary FHIRPath expressions and evaluates functions such as matches(), matchesFull(), and replaceMatches() using user-controlled regular expressions. These expressions are passed to Java's Pattern.compile() and String.replaceAll() through a timeout utility that fails to properly terminate the execution thread upon timeout. An attacker can exploit this by submitting a resource with a 'catastrophic backtracking' regex pattern, leading to 100% CPU exhaustion. The issue affects multiple modules including org.hl7.fhir.r4, r4b, and r5, and is fixed in versions 6.9.9 and 6.9.4.2.

Affected products

  • hapifhir org.hl7.fhir.core < 6.9.4.2, >= 6.9.5 < 6.9.9

Identifiers

  • CVE-2026-49485
  • GHSA-7cmj-v6x8-frvv

Timeline

  • 2026-05-29: patched: Fixes merged and releases 6.9.4.2 and 6.9.9 created.
  • 2026-06-01: advisory: GitHub Security Advisory GHSA-7cmj-v6x8-frvv published.
  • 2026-07-17: disclosed: CVE-2026-49485 published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.