Vulnerability Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches() in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matches(sw) without RegexTimeout protection while replaceMatches() was updated, allowing an unauthenticated attacker to trigger catastrophic regex backtracking and exhaust server CPU. This issue is fixed in version 6.9.10.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hapifhir | Hl7 Fhir Core | < 6.9.10 |
Related Weaknesses (CWE)
References
- https://github.com/hapifhir/org.hl7.fhir.core/commit/56376f7986222626af061ca7fc2Patch
- https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.10Release Notes
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-fxj4-p9xpExploitThird Party Advisory
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-fxj4-p9xpExploitThird Party Advisory
FAQ
What is CVE-2026-55470?
CVE-2026-55470 is a vulnerability with a CVSS score of 7.5 (HIGH). HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIR...
How severe is CVE-2026-55470?
CVE-2026-55470 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-55470?
Check the references section above for vendor advisories and patch information. Affected products include: Hapifhir Hl7 Fhir Core.