HAPI FHIR Library Vulnerability: Denial of Service Risk and Mitigation
SCA: security update for ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, ... | Tenable®
Summary
A vulnerability was found in HAPI FHIR, a Java implementation of the FHIR standard for healthcare interoperability. The issue stems from regex processing, which can be exploited by malicious patterns to exhaust CPU resources, causing a denial of service (DoS). Users must promptly update the library to the latest version.
Details
HAPI FHIR is a comprehensive Java implementation of the HL7 FHIR standard for healthcare interoperability. The vulnerability arises because the FHIRPathEngine accepts arbitrary FHIRPath expressions and evaluates them without proper input validation. Specifically, functions like `matches()`, `matchesFull()`, and `replaceMatches()` pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() via an incomplete timeout utility. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, thereby exhausting CPU resources and causing denial of service in the FHIR Validator HTTP endpoint and affected org.hl7.fhir.* modules. This issue is fixed in versions 6.9.9 and 6.9.4.2. Healthcare providers and developers are strongly advised to update affected libraries (e.g., ca.uhn.hapi.fhir:org.hl7.fhir.dstu2) to the latest secure version. Identified as CVE-2026-49485, this vulnerability carries a CVSS v3 Base Score of 7.5 (High Risk). Maintaining the reliability of data exchange infrastructure in healthcare requires immediate attention to this security update.
Original content copyright by respective publishers