CRITICAL9.8CVE-2026-33180HAPI FHIR HTTP authentication leak in redirects from 0, < 6.9.0
CRITICAL9.8CVE-2024-51132HAPI FHIR XML External Entity (XXE) vulnerability from 0, < 6.4.0
CRITICAL9.3CVE-2026-34361FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft from 0, < 6.9.4
CRITICAL9.1MITM based Zip Slip in `org.hl7.fhir.publisher:org.hl7.fhir.publisher`
from 0, < 5.6.92
HIGH7.5org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
>= 6.9.5, < 6.9.9
HIGH7.5HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
from 0, < 6.9.10
HIGH7.5HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
from 0, < 6.9.7
HIGH7.5HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057
from 0, < 5.6.106