Executive brief
HAPI FHIR is a Java-based library used by healthcare organizations to exchange and validate medical data. A flaw in its data processing engine allows an unauthenticated attacker to send specially crafted requests that cause the server's processor to become overwhelmed. This can lead to a complete service outage, preventing legitimate users and medical systems from accessing or sharing critical healthcare information.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) caused by an incomplete patch for CVE-2026-45367. While other modules were updated to use 'RegexTimeout' protection, the 'matches()' function in 'org.hl7.fhir.dstu2/utils/FHIRPathEngine.java' continued to call the raw 'String.matches()' method. An unauthenticated attacker can exploit this by submitting a FHIR resource or FHIRPath expression containing a complex regular expression designed to trigger catastrophic backtracking. This results in 100% CPU exhaustion on the host server. The issue is resolved in version 6.9.10 by ensuring all FHIRPath 'matches' calls are time-bounded.
Affected products
- HAPI FHIR org.hl7.fhir.core < 6.9.10
- HAPI FHIR org.hl7.fhir.dstu2 <= 6.9.9
- HAPI FHIR org.hl7.fhir.validation <= 6.9.9
Timeline
- 2026-06-12: patched: Version 6.9.10 released
- 2026-06-17: advisory: GitHub Security Advisory published
- 2026-07-08: disclosed: CVE-2026-55470 published to NVD