CVE-2026-49485

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49485", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-30T04:17:43.095Z", "datePublished": "2026-07-17T20:59:47.800Z", "dateUpdated": "2026-07-20T13:45:26.634Z"}, "containers": {"cna": {"title": "HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "lang": "en", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-7cmj-v6x8-frvv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-7cmj-v6x8-frvv"}, {"name": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2463", "tags": ["x_refsource_MISC"], "url": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2463"}, {"name": "https://github.com/hapifhir/org.hl7.fhir.core/commit/109c88837c032ef399b2eb87ddde86692065cf41", "tags": ["x_refsource_MISC"], "url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/109c88837c032ef399b2eb87ddde86692065cf41"}, {"name": "https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed", "tags": ["x_refsource_MISC"], "url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed"}, {"name": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.4.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.4.2"}, {"name": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.9"}], "affected": [{"vendor": "hapifhir", "product": "org.hl7.fhir.core", "versions": [{"version": "< 6.9.4.2", "status": "affected"}, {"version": ">= 6.9.5, < 6.9.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-17T20:59:47.800Z"}, "descriptions": [{"lang": "en", "value": "HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through an incomplete timeout utility. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting CPU resources and causing denial of service in the FHIR Validator HTTP endpoint and affected org.hl7.fhir.* modules. This issue is fixed in versions 6.9.9 and 6.9.4.2."}], "source": {"advisory": "GHSA-7cmj-v6x8-frvv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T13:45:18.499715Z", "id": "CVE-2026-49485", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T13:45:26.634Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49485", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T13:45:18.499715Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T13:45:23.080Z"}}], "cna": {"title": "HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint", "source": {"advisory": "GHSA-7cmj-v6x8-frvv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "hapifhir", "product": "org.hl7.fhir.core", "versions": [{"status": "affected", "version": "< 6.9.4.2"}, {"status": "affected", "version": ">= 6.9.5, < 6.9.9"}]}], "references": [{"url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-7cmj-v6x8-frvv", "name": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-7cmj-v6x8-frvv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2463", "name": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2463", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/109c88837c032ef399b2eb87ddde86692065cf41", "name": "https://github.com/hapifhir/org.hl7.fhir.core/commit/109c88837c032ef399b2eb87ddde86692065cf41", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed", "name": "https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.4.2", "name": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.4.2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.9", "name": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.9", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through an incomplete timeout utility. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting CPU resources and causing denial of service in the FHIR Validator HTTP endpoint and affected org.hl7.fhir.* modules. This issue is fixed in versions 6.9.9 and 6.9.4.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-17T20:59:47.800Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49485", "state": "PUBLISHED", "dateUpdated": "2026-07-20T13:45:26.634Z", "dateReserved": "2026-05-30T04:17:43.095Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-17T20:59:47.800Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "org.hl7.fhir.core", "vendor": "hapifhir", "versions": [{"status": "affected", "version": "< 6.9.4.2"}, {"status": "affected", "version": ">= 6.9.5, < 6.9.9"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through an incomplete timeout utility. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting CPU resources and causing denial of service in the FHIR Validator HTTP endpoint and affected org.hl7.fhir.* modules. This issue is fixed in versions 6.9.9 and 6.9.4.2."}, {"lang": "es", "value": "HAPI FHIR es una implementaci\u00f3n completa del est\u00e1ndar HL7 FHIR para la interoperabilidad sanitaria en Java. Antes de las versiones 6.9.9 y 6.9.4.2, todas las implementaciones de FHIRPathEngine aceptan expresiones FHIRPath arbitrarias y las eval\u00faan sin validaci\u00f3n de entrada, y las funciones FHIRPath matches(), matchesFull() y replaceMatches() pasan expresiones regulares controladas por el usuario a Pattern.compile() y String.replaceAll() de Java a trav\u00e9s de una utilidad de tiempo de espera incompleta. Un atacante puede enviar un recurso que contenga un patr\u00f3n de regex malicioso que cause un retroceso catastr\u00f3fico, agotando los recursos de la CPU y provocando una denegaci\u00f3n de servicio en el endpoint HTTP del validador FHIR y en los m\u00f3dulos org.hl7.fhir.* afectados. Este problema est\u00e1 solucionado en las versiones 6.9.9 y 6.9.4.2."}], "id": "CVE-2026-49485", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49485", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T13:45:18.499715Z", "version": "2.0.3"}}]}, "published": "2026-07-17T22:17:16.893", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/109c88837c032ef399b2eb87ddde86692065cf41"}, {"source": "security-advisories@github.com", "url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed"}, {"source": "security-advisories@github.com", "url": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2463"}, {"source": "security-advisories@github.com", "url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.4.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.9"}, {"source": "security-advisories@github.com", "url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-7cmj-v6x8-frvv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-1333"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,6.9.4.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.9.5,6.9.9)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "org.hl7.fhir.core", "source": "cna", "vendor": "hapifhir"}, "product": "hl7_fhir_core", "vendor": "hapifhir"}], "created": "2026-07-22T19:45:17.010527+00:00", "updated": "2026-07-30T23:30:08.664398+00:00", "vendors": ["hapifhir", "hapifhir$PRODUCT$hl7_fhir_core"]}