HAPI FHIR Vulnerability: Risk of Service Disruption via Regex

Details

This is a high-severity security vulnerability reported as CVE-2026-49485. HAPI FHIR, which implements the HL7 FHIR standard in Java, contains an issue within its FHIRPathEngine. The core problem arises because this engine accepts arbitrary FHIRPath expressions without input validation. Specifically, functions like `matches()` and `replaceMatches()` pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through an incomplete timeout utility. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, thereby exhausting CPU resources and causing denial of service in the FHIR Validator HTTP endpoint and affected org.hl7.fhir.* modules. This vulnerability is fixed in versions 6.9.9 and 6.9.4.2. Organizations utilizing the FHIR standard for healthcare interoperability must update their systems promptly to mitigate this risk.