{"id":"CVE-2026-49485","title":"ca.uhn.hapi.fhir/org.hl7.fhir.dstu2: ca.uhn.hapi.fhir/org.hl7.fhir.dstu2016may: ca.uhn.hapi.fhir/org.hl7.fhir.dstu3: ca.uhn.hapi.fhir/org.h…","summary":"A flaw was found in HAPI FHIR, a Java implementation of the HL7 FHIR standard. A remote attacker can exploit this vulnerability by submitting a crafted resource that contains a malicious regular expression. This can lead to a denial of ser…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-1333","CWE-400"],"vendor":"Red Hat","product":"Red Hat Fuse 7","affected":["build_of_apache_camel_4_for_quarkus 3","fuse 7"],"patched":["ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 6.9.9","ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may 6.9.9","ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 6.9.9","ca.uhn.hapi.fhir:org.hl7.fhir.r4 6.9.9","ca.uhn.hapi.fhir:org.hl7.fhir.r4b 6.9.9","ca.uhn.hapi.fhir:org.hl7.fhir.r5 6.9.9","ca.uhn.hapi.fhir:org.hl7.fhir.validation 6.9.9","ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli 6.9.9","ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 6.9.4.2","ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may 6.9.4.2","ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 6.9.4.2","ca.uhn.hapi.fhir:org.hl7.fhir.r4 6.9.4.2","ca.uhn.hapi.fhir:org.hl7.fhir.r4b 6.9.4.2","ca.uhn.hapi.fhir:org.hl7.fhir.r5 6.9.4.2","ca.uhn.hapi.fhir:org.hl7.fhir.validation 6.9.4.2","ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli 6.9.4.2"],"published":"2026-07-17","updated":"2026-10-23","sourceUpdated":"2026-10-23T15:22:38+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49485.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49485.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-49485"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2501967"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49485"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49485"},{"url":"https://github.com/hapifhir/org.hl7.fhir.core/commit/109c88837c032ef399b2eb87ddde86692065cf41"},{"url":"https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed"},{"url":"https://github.com/hapifhir/org.hl7.fhir.core/pull/2463"},{"url":"https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.4.2"},{"url":"https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.9"},{"url":"https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-7cmj-v6x8-frvv"},{"url":"https://github.com/advisories/GHSA-7cmj-v6x8-frvv"}],"tags":["csaf","vex","red-hat","ghsa","maven"],"epss":0.00684,"epssPercentile":0.52373,"aliases":["GHSA-7cmj-v6x8-frvv"],"ecosystem":"maven","ingestedAt":"2026-07-09T13:51:05.174Z","slug":"CVE-2026-49485","body":"## Overview\n\nA flaw was found in HAPI FHIR, a Java implementation of the HL7 FHIR standard. A remote attacker can exploit this vulnerability by submitting a crafted resource that contains a malicious regular expression. This can lead to a denial of service (DoS) due to excessive CPU resource consumption when the FHIRPathEngine attempts to process the malformed expression without adequate input validation.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat Fuse 7 · no fix planned: Red Hat Fuse 7, Red Hat build of Apache Camel 4 for Quarkus 3 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49485.json)\n\n**ca.uhn.hapi.fhir/org.hl7.fhir.dstu2: ca.uhn.hapi.fhir/org.hl7.fhir.dstu2016may: ca.uhn.hapi.fhir/org.hl7.fhir.dstu3: ca.uhn.hapi.fhir/org.hl7.fhir.r4: ca.uhn.hapi.fhir/org.hl7.fhir.r4b: ca.uhn.hapi.fhir/org.hl7.fhir.r5: ca.uhn.hapi.fhir/org.hl7.fhir.validation: ca.uhn.hapi.fhir/org.hl7.fhir.validation.cli: HAPI FHIR: Denial of Service via malicious regular expressions** — rated Important by Red Hat. Released 2026-07-17, updated 2026-10-23.\n\nAffected:\n\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- Red Hat Fuse 7\n\nNo fix planned:\n\n- Red Hat Fuse 7\n- Red Hat build of Apache Camel 4 for Quarkus 3\n\n## Remediation\n\nFix deferred\n\n## Package advisory (CVE-2026-49485)\n\nAffected packages:\n\n- `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 >= 6.9.5, < 6.9.9`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may >= 6.9.5, < 6.9.9`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 >= 6.9.5, < 6.9.9`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.r4 >= 6.9.5, < 6.9.9`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.r4b >= 6.9.5, < 6.9.9`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.r5 >= 6.9.5, < 6.9.9`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.validation >= 6.9.5, < 6.9.9`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli >= 6.9.5, < 6.9.9`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 < 6.9.4.2`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may < 6.9.4.2`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 < 6.9.4.2`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.r4 < 6.9.4.2`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.r4b < 6.9.4.2`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.r5 < 6.9.4.2`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.validation < 6.9.4.2`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli < 6.9.4.2`\n\nPatched in:\n\n- `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 6.9.9`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may 6.9.9`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 6.9.9`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.r4 6.9.9`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.r4b 6.9.9`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.r5 6.9.9`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.validation 6.9.9`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli 6.9.9`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 6.9.4.2`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may 6.9.4.2`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 6.9.4.2`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.r4 6.9.4.2`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.r4b 6.9.4.2`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.r5 6.9.4.2`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.validation 6.9.4.2`\n- `ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli 6.9.4.2`\n\nSource: https://github.com/advisories/GHSA-7cmj-v6x8-frvv","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}