pkg:Maven/ca.uhn.hapi.fhir:org.hl7.fhir.validation

All known vulnerabilities

• CRITICAL9.8CVE-2026-33180HAPI FHIR HTTP authentication leak in redirects
  from 0, < 6.9.0
• CRITICAL9.8CVE-2024-51132HAPI FHIR XML External Entity (XXE) vulnerability
  from 0, < 6.4.0
• CRITICAL9.3CVE-2026-34361FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
  from 0, < 6.9.4
• CRITICAL9.1MITM based Zip Slip in `org.hl7.fhir.publisher:org.hl7.fhir.publisher`
  from 0, < 5.6.92
• HIGH7.5org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
  >= 6.9.5, < 6.9.9
• HIGH7.5HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
  from 0, < 6.9.10
• HIGH7.5HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
  from 0, < 6.9.7
• HIGH7.5HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057
  from 0, < 5.6.106