Product by Hapifhir

HAPI FHIR HL7 FHIR Core

7 known vulnerabilities in HAPI FHIR HL7 FHIR Core (Hapifhir), 0 of them actively exploited (CISA KEV).

Vulnerabilities

Actively exploited (KEV)

Used by ransomware

Critical

Vulnerabilities

Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

Vulnerabilities in HAPI FHIR HL7 FHIR Core (Hapifhir)

Critical	CVE-2026-55471	HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory also in 1 other product	9.1	08.07.2026
High	CVE-2023-28465	HAPI FHIR HL7 FHIR Core: Path Traversal	7.5	12.12.2023
High	CVE-2026-55470	HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS also in 1 other product	7.5	08.07.2026
High	CVE-2023-24057	HAPI FHIR HL7 FHIR Core: Path Traversal also in 1 other product	8.1	24.01.2023
Critical	CVE-2026-34361	Hapifhir Org.hl7.fhir.core: Files or Directories Accessible to External Parties also in 1 other product	9.3	31.03.2026
Critical	CVE-2026-34359	Hapifhir Org.hl7.fhir.core: Origin Validation Error also in 1 other product	7.4	31.03.2026
Medium	CVE-2026-34360	HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing also in 1 other product	5.8	31.03.2026