What’s Vulnerable › Products
hapifhir org.hl7.fhir.core vulnerabilities
17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.
Check whether your hapifhir org.hl7.fhir.core version is affected
Latest hapifhir org.hl7.fhir.core vulnerabilities
- CVE-2026-81876 — HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service (CVSS 7.5)
- CVE-2026-81875 — HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service (CVSS 7.5)
- CVE-2026-62296 — HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service (CVSS 7.5)
- CVE-2026-62295 — HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service (CVSS 7.5)
- CVE-2026-62293 — HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles (CVSS 5.0)
- CVE-2026-49485 — HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint (CVSS 7.5)
- CVE-2026-45367 — HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint (CVSS 7.5)
- CVE-2026-55471 — HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory (CVSS 9.1)
- CVE-2026-55470 — HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS (CVSS 7.5)
- CVE-2026-34361 — HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft (CVSS 9.3)
- CVE-2026-34360 — HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing (CVSS 5.8)
- CVE-2026-34359 — HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core (CVSS 9.1)
- CVE-2026-33180 — HAPI FHIR HTTP authentication leak in redirects (CVSS 7.5)
- CVE-2024-52007 — XXE vulnerability in XSLT parsing in `org.hl7.fhir.core` (CVSS 8.6)
- CVE-2024-45294 — `org.hl7.fhir.core` XXE vulnerability in XSLT transforms (CVSS 8.6)
- CVE-2023-28465 — (CVSS 7.5)
- CVE-2023-24057 — (CVSS 8.1)