CVE-2026-45367

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45367
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45367.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45367
Aliases
Downstream
Published
2026-07-16T16:52:04.901Z
Modified
2026-08-07T21:32:28.086205Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Details

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1333"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45367.json"
}
References

Affected packages

Git / github.com/hapifhir/org.hl7.fhir.core

Affected ranges

Type
GIT
Repo
https://github.com/hapifhir/org.hl7.fhir.core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
275d015c680ce9f90cbe285596e50118e472bf24
Fixed
e08982d2b6f6dcd6c670a762d9cf999179fbe4ed
Fixed
1ab4fece6bbed67a32eb40ffd328bbcc517e1b90
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.9.7"
        }
    ]
}

Affected versions

6.*
6.7.11
6.8.1
6.8.2
6.9.0
6.9.1
6.9.2
6.9.3
6.9.4
6.9.5
6.9.6
6.9.7
6.9.8

Database specific

vanir_signatures_modified 
"2026-08-07T21:32:28Z"
vanir_signatures 
[
    {
        "target": {
            "file": "org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/fhirpath/FHIRPathEngine.java"
        },
        "digest": {
            "line_hashes": [
                "43499012994793408893157700780454680446",
                "249082112536563280810231214905672556969",
                "236935494799903933499787003447718018345",
                "251790034543609633298560549322153625168",
                "279734113099875176591433232311587481736",
                "61060354968361056476717605558589809181"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2026-45367-227497a9",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed"
    },
    {
        "target": {
            "function": "funcReplaceMatches",
            "file": "org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/fhirpath/FHIRPathEngine.java"
        },
        "digest": {
            "length": 852.0,
            "function_hash": "273153563252725350936223244141709784680"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-45367-308b839b",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed"
    },
    {
        "target": {
            "function": "funcReplaceMatches",
            "file": "org.hl7.fhir.r4/src/main/java/org/hl7/fhir/r4/fhirpath/FHIRPathEngine.java"
        },
        "digest": {
            "length": 852.0,
            "function_hash": "273153563252725350936223244141709784680"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-45367-9ed27f07",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed"
    },
    {
        "target": {
            "file": "org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/fhirpath/FHIRPathEngine.java"
        },
        "digest": {
            "line_hashes": [
                "230659167557096620682807740672335353140",
                "249082112536563280810231214905672556969",
                "236935494799903933499787003447718018345",
                "251790034543609633298560549322153625168",
                "279734113099875176591433232311587481736",
                "61060354968361056476717605558589809181"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2026-45367-d90f8e00",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed"
    },
    {
        "target": {
            "file": "org.hl7.fhir.r4/src/main/java/org/hl7/fhir/r4/fhirpath/FHIRPathEngine.java"
        },
        "digest": {
            "line_hashes": [
                "99665452176298689026932617582561185482",
                "52054904108926253390301950663499886774",
                "12684320107799510912171962131001316380",
                "3743395136450466360040054787158858833",
                "230659167557096620682807740672335353140",
                "249082112536563280810231214905672556969",
                "236935494799903933499787003447718018345",
                "251790034543609633298560549322153625168",
                "279734113099875176591433232311587481736",
                "61060354968361056476717605558589809181"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2026-45367-de323a46",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed"
    },
    {
        "target": {
            "function": "funcReplaceMatches",
            "file": "org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/fhirpath/FHIRPathEngine.java"
        },
        "digest": {
            "length": 900.0,
            "function_hash": "10285593845121762161224536742927058120"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-45367-ed5ef33b",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45367.json"