CVE-2026-34360

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-34360

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34360.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-34360

Aliases

GHSA-3ww8-jw56-9f5h

Published

2026-03-31T16:56:05.034Z

Modified

2026-04-10T05:43:02.255057Z

Severity

5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS Calculator

Summary

HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing

Details

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the /loadIG HTTP endpoint in the FHIR Validator HTTP service accepts a user-supplied URL via JSON body and makes server-side HTTP requests to it without any hostname, scheme, or domain validation. An unauthenticated attacker with network access to the validator can probe internal network services, cloud metadata endpoints, and map network topology through error-based information leakage. With explore=true (the default for this code path), each request triggers multiple outbound HTTP calls, amplifying reconnaissance capability. This issue has been patched in version 6.9.4.

Database specific

{
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34360.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/hapifhir/org.hl7.fhir.core

Affected ranges

Type

GIT

Repo

https://github.com/hapifhir/org.hl7.fhir.core

Events

Introduced

Fixed

8ac83ba8e6c1f1e1230180a984ffcccfab291e1d

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.9.4"
        }
    ]
}

Affected versions

6.*

6.7.11

6.8.1

6.8.2

6.9.0

6.9.1

6.9.2

6.9.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34360.json"