--- id: CVE-2026-49485 title: >- ca.uhn.hapi.fhir/org.hl7.fhir.dstu2: ca.uhn.hapi.fhir/org.hl7.fhir.dstu2016may: ca.uhn.hapi.fhir/org.hl7.fhir.dstu3: ca.uhn.hapi.fhir/org.h… summary: >- A flaw was found in HAPI FHIR, a Java implementation of the HL7 FHIR standard. A remote attacker can exploit this vulnerability by submitting a crafted resource that contains a malicious regular expression. This can lead to a denial of ser… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cvssSource: vendor cwe: - CWE-1333 - CWE-400 vendor: Red Hat product: Red Hat Fuse 7 affected: - build_of_apache_camel_4_for_quarkus 3 - fuse 7 patched: - 'ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 6.9.9' - 'ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may 6.9.9' - 'ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 6.9.9' - 'ca.uhn.hapi.fhir:org.hl7.fhir.r4 6.9.9' - 'ca.uhn.hapi.fhir:org.hl7.fhir.r4b 6.9.9' - 'ca.uhn.hapi.fhir:org.hl7.fhir.r5 6.9.9' - 'ca.uhn.hapi.fhir:org.hl7.fhir.validation 6.9.9' - 'ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli 6.9.9' - 'ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 6.9.4.2' - 'ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may 6.9.4.2' - 'ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 6.9.4.2' - 'ca.uhn.hapi.fhir:org.hl7.fhir.r4 6.9.4.2' - 'ca.uhn.hapi.fhir:org.hl7.fhir.r4b 6.9.4.2' - 'ca.uhn.hapi.fhir:org.hl7.fhir.r5 6.9.4.2' - 'ca.uhn.hapi.fhir:org.hl7.fhir.validation 6.9.4.2' - 'ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli 6.9.4.2' published: '2026-07-17' updated: '2026-10-23' sourceUpdated: '2026-10-23T15:22:38+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49485.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49485.json - url: 'https://access.redhat.com/security/cve/CVE-2026-49485' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2501967' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-49485' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49485' - url: >- https://github.com/hapifhir/org.hl7.fhir.core/commit/109c88837c032ef399b2eb87ddde86692065cf41 - url: >- https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed - url: 'https://github.com/hapifhir/org.hl7.fhir.core/pull/2463' - url: 'https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.4.2' - url: 'https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.9' - url: >- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-7cmj-v6x8-frvv - url: 'https://github.com/advisories/GHSA-7cmj-v6x8-frvv' tags: - csaf - vex - red-hat - ghsa - maven epss: 0.00684 epssPercentile: 0.52373 aliases: - GHSA-7cmj-v6x8-frvv ecosystem: maven ingestedAt: '2026-07-09T13:51:05.174Z' --- ## Overview A flaw was found in HAPI FHIR, a Java implementation of the HL7 FHIR standard. A remote attacker can exploit this vulnerability by submitting a crafted resource that contains a malicious regular expression. This can lead to a denial of service (DoS) due to excessive CPU resource consumption when the FHIRPathEngine attempts to process the malformed expression without adequate input validation. ## Vendor advisories - **Red Hat VEX** · Important · affected: Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat Fuse 7 · no fix planned: Red Hat Fuse 7, Red Hat build of Apache Camel 4 for Quarkus 3 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49485.json) **ca.uhn.hapi.fhir/org.hl7.fhir.dstu2: ca.uhn.hapi.fhir/org.hl7.fhir.dstu2016may: ca.uhn.hapi.fhir/org.hl7.fhir.dstu3: ca.uhn.hapi.fhir/org.hl7.fhir.r4: ca.uhn.hapi.fhir/org.hl7.fhir.r4b: ca.uhn.hapi.fhir/org.hl7.fhir.r5: ca.uhn.hapi.fhir/org.hl7.fhir.validation: ca.uhn.hapi.fhir/org.hl7.fhir.validation.cli: HAPI FHIR: Denial of Service via malicious regular expressions** — rated Important by Red Hat. Released 2026-07-17, updated 2026-10-23. Affected: - Red Hat build of Apache Camel 4 for Quarkus 3 - Red Hat Fuse 7 No fix planned: - Red Hat Fuse 7 - Red Hat build of Apache Camel 4 for Quarkus 3 ## Remediation Fix deferred ## Package advisory (CVE-2026-49485) Affected packages: - `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 >= 6.9.5, < 6.9.9` - `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may >= 6.9.5, < 6.9.9` - `ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 >= 6.9.5, < 6.9.9` - `ca.uhn.hapi.fhir:org.hl7.fhir.r4 >= 6.9.5, < 6.9.9` - `ca.uhn.hapi.fhir:org.hl7.fhir.r4b >= 6.9.5, < 6.9.9` - `ca.uhn.hapi.fhir:org.hl7.fhir.r5 >= 6.9.5, < 6.9.9` - `ca.uhn.hapi.fhir:org.hl7.fhir.validation >= 6.9.5, < 6.9.9` - `ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli >= 6.9.5, < 6.9.9` - `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 < 6.9.4.2` - `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may < 6.9.4.2` - `ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 < 6.9.4.2` - `ca.uhn.hapi.fhir:org.hl7.fhir.r4 < 6.9.4.2` - `ca.uhn.hapi.fhir:org.hl7.fhir.r4b < 6.9.4.2` - `ca.uhn.hapi.fhir:org.hl7.fhir.r5 < 6.9.4.2` - `ca.uhn.hapi.fhir:org.hl7.fhir.validation < 6.9.4.2` - `ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli < 6.9.4.2` Patched in: - `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 6.9.9` - `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may 6.9.9` - `ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 6.9.9` - `ca.uhn.hapi.fhir:org.hl7.fhir.r4 6.9.9` - `ca.uhn.hapi.fhir:org.hl7.fhir.r4b 6.9.9` - `ca.uhn.hapi.fhir:org.hl7.fhir.r5 6.9.9` - `ca.uhn.hapi.fhir:org.hl7.fhir.validation 6.9.9` - `ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli 6.9.9` - `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 6.9.4.2` - `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may 6.9.4.2` - `ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 6.9.4.2` - `ca.uhn.hapi.fhir:org.hl7.fhir.r4 6.9.4.2` - `ca.uhn.hapi.fhir:org.hl7.fhir.r4b 6.9.4.2` - `ca.uhn.hapi.fhir:org.hl7.fhir.r5 6.9.4.2` - `ca.uhn.hapi.fhir:org.hl7.fhir.validation 6.9.4.2` - `ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli 6.9.4.2` Source: https://github.com/advisories/GHSA-7cmj-v6x8-frvv