CVE-2026-49485High· 7.5▾ TwilightA flaw was found in HAPI FHIR, a Java implementation of the HL7 FHIR standard. A remote attacker can exploit this vulnerability by submitting a crafted resource that contains a malicious regular expression. This can lead to a denial of ser…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
0.4% → 0.7%
Last analysed / modified upstream
A flaw was found in HAPI FHIR, a Java implementation of the HL7 FHIR standard. A remote attacker can exploit this vulnerability by submitting a crafted resource that contains a malicious regular expression. This can lead to a denial of service (DoS) due to excessive CPU resource consumption when the FHIRPathEngine attempts to process the malformed expression without adequate input validation.
ca.uhn.hapi.fhir/org.hl7.fhir.dstu2: ca.uhn.hapi.fhir/org.hl7.fhir.dstu2016may: ca.uhn.hapi.fhir/org.hl7.fhir.dstu3: ca.uhn.hapi.fhir/org.hl7.fhir.r4: ca.uhn.hapi.fhir/org.hl7.fhir.r4b: ca.uhn.hapi.fhir/org.hl7.fhir.r5: ca.uhn.hapi.fhir/org.hl7.fhir.validation: ca.uhn.hapi.fhir/org.hl7.fhir.validation.cli: HAPI FHIR: Denial of Service via malicious regular expressions — rated Important by Red Hat. Released 2026-07-17, updated 2026-10-23.
Affected:
No fix planned:
Fix deferred
Affected packages:
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 >= 6.9.5, < 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may >= 6.9.5, < 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 >= 6.9.5, < 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.r4 >= 6.9.5, < 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.r4b >= 6.9.5, < 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.r5 >= 6.9.5, < 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.validation >= 6.9.5, < 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli >= 6.9.5, < 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 < 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may < 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 < 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.r4 < 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.r4b < 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.r5 < 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.validation < 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli < 6.9.4.2Patched in:
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.r4 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.r4b 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.r5 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.validation 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.r4 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.r4b 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.r5 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.validation 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli 6.9.4.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-45367High· 7.5HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java
CVE-2026-13149High· 7.5brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)
CVE-2026-49477High· 7.5soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings (CVE-2026-49477)
CVE-2026-116141Medium· 5.3ImageMagick: ImageMagick: Denial of Service via policy bypass in UHDR decoder (CVE-2026-116141)
CVE-2026-80344High· 8.2org.apache.camel/camel-as2: Apache Camel AS2: Server-Side Request Forgery via unvalidated receipt destination (CVE-2026-80344)
CVE-2024-58379Medium· 5.3nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments