CVE-2026-45367

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45367", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-12T00:51:29.085Z", "datePublished": "2026-07-16T16:52:04.901Z", "dateUpdated": "2026-07-18T03:00:14.087Z"}, "containers": {"cna": {"title": "HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "lang": "en", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3653-68v6-rq57", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3653-68v6-rq57"}, {"name": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2403", "tags": ["x_refsource_MISC"], "url": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2403"}, {"name": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2463", "tags": ["x_refsource_MISC"], "url": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2463"}, {"name": "https://github.com/hapifhir/org.hl7.fhir.core/commit/275d015c680ce9f90cbe285596e50118e472bf24", "tags": ["x_refsource_MISC"], "url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/275d015c680ce9f90cbe285596e50118e472bf24"}, {"name": "https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed", "tags": ["x_refsource_MISC"], "url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed"}, {"name": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.7"}], "affected": [{"vendor": "hapifhir", "product": "org.hl7.fhir.core", "versions": [{"version": "< 6.9.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-16T16:52:04.901Z"}, "descriptions": [{"lang": "en", "value": "HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7."}], "source": {"advisory": "GHSA-3653-68v6-rq57", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-18T02:59:58.378253Z", "id": "CVE-2026-45367", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-18T03:00:14.087Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45367", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-18T02:59:58.378253Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-18T03:00:06.819Z"}}], "cna": {"title": "HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint", "source": {"advisory": "GHSA-3653-68v6-rq57", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "hapifhir", "product": "org.hl7.fhir.core", "versions": [{"status": "affected", "version": "< 6.9.7"}]}], "references": [{"url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3653-68v6-rq57", "name": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3653-68v6-rq57", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2403", "name": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2403", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2463", "name": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2463", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/275d015c680ce9f90cbe285596e50118e472bf24", "name": "https://github.com/hapifhir/org.hl7.fhir.core/commit/275d015c680ce9f90cbe285596e50118e472bf24", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed", "name": "https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.7", "name": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-16T16:52:04.901Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45367", "state": "PUBLISHED", "dateUpdated": "2026-07-18T03:00:14.087Z", "dateReserved": "2026-05-12T00:51:29.085Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-16T16:52:04.901Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "org.hl7.fhir.core", "vendor": "hapifhir", "versions": [{"status": "affected", "version": "< 6.9.7"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7."}, {"lang": "es", "value": "HAPI FHIR es una implementaci\u00f3n completa del est\u00e1ndar HL7 FHIR para la interoperabilidad sanitaria en Java. Antes de la versi\u00f3n 6.9.7, la implementaci\u00f3n de FHIRPathEngine pasa expresiones regulares controladas por el usuario de matches(), matchesFull() y replaceMatches() a operaciones de expresiones regulares de Java sin tiempos de espera efectivos, lo que permite un retroceso catastr\u00f3fico y denegaci\u00f3n de servicio. Este problema se ha solucionado en la versi\u00f3n 6.9.7."}], "id": "CVE-2026-45367", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45367", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-18T02:59:58.378253Z", "version": "2.0.3"}}]}, "published": "2026-07-16T17:16:56.293", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/275d015c680ce9f90cbe285596e50118e472bf24"}, {"source": "security-advisories@github.com", "url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed"}, {"source": "security-advisories@github.com", "url": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2403"}, {"source": "security-advisories@github.com", "url": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2463"}, {"source": "security-advisories@github.com", "url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.7"}, {"source": "security-advisories@github.com", "url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3653-68v6-rq57"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1333"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.9.7)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "org.hl7.fhir.core", "source": "cna", "vendor": "hapifhir"}, "product": "hl7_fhir_core", "vendor": "hapifhir"}], "created": "2026-07-17T03:45:04.314621+00:00", "updated": "2026-07-31T01:45:06.885388+00:00", "vendors": ["hapifhir", "hapifhir$PRODUCT$hl7_fhir_core"]}