CVE-2026-55470 | HAPI FHIR is a complete implementation of the HL7 FHIR stand… | CVSS 7.5 HIGH

Description

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches() in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matches(sw) without RegexTimeout protection while replaceMatches() was updated, allowing an unauthenticated attacker to trigger catastrophic regex backtracking and exhaust server CPU. This issue is fixed in version 6.9.10.

Metadata

CVE ID: CVE-2026-55470
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-16 22:10 UTC
Published: 2026-07-08 21:27 UTC
Last updated: 2026-07-08 21:27 UTC
Primary CWE: CWE-1333
CWE-1333: Inefficient Regular Expression Complexity
Vendor / Product: hapifhir / org.hl7.fhir.core
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products (1)

Vendor	Product	Platform	Versions
hapifhir	org.hl7.fhir.core	—	< 6.9.10

Weakness (CWE)

CWE	Source	Description
CWE-1333	cna	CWE-1333: Inefficient Regular Expression Complexity

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (3)

https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-fxj4-p9xp-37v5 https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-fxj4-p9xp-37v5
https://github.com/hapifhir/org.hl7.fhir.core/commit/56376f7986222626af061ca7fc27ee1ab030e590 https://github.com/hapifhir/org.hl7.fhir.core/commit/56376f7986222626af061ca7fc27ee1ab030e590
https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.10 https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.10