REDHAT-BUG-2498308: High severity Hapi HAPI FHIR vulnerability
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches() in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matches(sw) without RegexTimeout protection while replaceMatches() was updated, allowing an unauthenticated attacker to trigger catastrophic regex backtracking and exhaust server CPU. This issue is fixed in version 6.9.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HAPI FHIRto a version that resolves this vulnerability.Fixed in 6.9.10Patch CVE-2026-45367
Event History
Frequently Asked Questions
Which deployments are affected?
HAPI FHIR versions earlier than 6.9.10 are affected where the DSTU2 module is in use. The issue is in DSTU2's FHIRPathEngine.matches() implementation.
Does exploitation require authentication?
No. The issue can be triggered by an unauthenticated attacker, resulting in catastrophic regular-expression backtracking and server CPU exhaustion.
How can I determine whether an instance needs remediation?
Check the deployed HAPI FHIR version and whether the DSTU2 module is used. Instances running a version earlier than 6.9.10 should be treated as affected.
What version contains the fix?
The issue is fixed in HAPI FHIR version 6.9.10.