Product by Hapifhir

    Org.hl7.fhir.core

    15 known vulnerabilities in Org.hl7.fhir.core (Hapifhir), 0 of them actively exploited (CISA KEV).

    Key figures

    15

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Org.hl7.fhir.core (Hapifhir)
    HighCVE-2026-81875

    HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service

    		7.5
    HighCVE-2026-81876

    HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

    		7.5
    CriticalCVE-2026-55471

    HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

    also in 1 other product

    		9.1
    HighCVE-2026-49485

    HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

    		7.5
    HighCVE-2024-45294

    `org.hl7.fhir.core` XXE vulnerability in XSLT transforms

    		8.6
    HighCVE-2026-45367

    HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

    		7.5
    HighCVE-2026-55470

    HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

    also in 1 other product

    		7.5
    HighCVE-2024-52007

    XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

    		8.6
    HighCVE-2026-62296

    HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service

    also in 2 other products

    		7.5
    HighCVE-2026-62295

    HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service

    also in 2 other products

    		7.5
    CriticalCVE-2026-34361

    Hapifhir Org.hl7.fhir.core: Files or Directories Accessible to External Parties

    also in 1 other product

    		9.3
    HighCVE-2026-33180

    HAPI FHIR HTTP authentication leak in redirects

    		7.5
    CriticalCVE-2026-34359

    Hapifhir Org.hl7.fhir.core: Origin Validation Error

    also in 1 other product

    		7.4
    MediumCVE-2026-62293

    HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles

    also in 2 other products

    		5.0
    MediumCVE-2026-34360

    HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing

    also in 1 other product

    		5.8

    All products by Hapifhir