CVE-2026-45367

Published: Jul 16, 2026Modified: Jul 18, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.

Related CWEs

Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References (6)

https://github.com/hapifhir/org.hl7.fhir.core/commit/275d015c680ce9f90cbe285596e50118e472bf24

Source: security-advisories@github.com

https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed

Source: security-advisories@github.com

https://github.com/hapifhir/org.hl7.fhir.core/pull/2403

Source: security-advisories@github.com

https://github.com/hapifhir/org.hl7.fhir.core/pull/2463

Source: security-advisories@github.com

https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.7

Source: security-advisories@github.com

https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3653-68v6-rq57

Source: security-advisories@github.com

Timeline

No history available yet.