Most recent entries from all

EUVD-2026-335238

2026-10-03T22:20:03.567896+00:00

EUVD-2026-335238

fkie_cve-2026-55471

2026-10-03T22:20:03.567945+00:00

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform(...) overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET restrictions, allowing an attacker who controls or can tamper with transformed XML to trigger XML External Entity injection for local file disclosure and blind XXE or SSRF to arbitrary URLs reachable from the host. This issue is fixed in version 6.9.10.

GHSA-2f55-g35j-5jmf — HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

2026-10-03T22:20:03.567993+00:00

Affected: Maven: ca.uhn.hapi.fhir:org.hl7.fhir.utilities

### Summary

`org.hl7.fhir.utilities.XsltUtilities` exposes two parallel families of XSLT transform helpers. The `transform(...)` overloads obtain their `TransformerFactory` from the project's hardened helper `XMLUtil.newXXEProtectedTransformerFactory()` (which sets `ACCESS_EXTERNAL_DTD=""` and `ACCESS_EXTERNAL_STYLESHEET=""`). The sibling `saxonTransform(...)` overloads instead instantiate a **bare** `new net.sf.saxon.TransformerFactoryImpl()` with no external-access restriction. A document transformed through any `saxonTransform(...)` overload is parsed with external general entities and external DTD/parameter entities enabled, so an attacker who controls (or can MITM) the transformed XML obtains XML External Entity injection: local file disclosure and blind XXE / SSRF to arbitrary URLs reachable from the host.

`XMLUtil` documents that its protected factory "should be the only place where TransformerFactory is instantiated in this project". The `saxonTransform` overloads violate that contract while their same-file `transform` siblings honour it.

### Affected versions

`org.hl7.fhir.utilities` (Maven `ca.uhn.hapi.fhir:org.hl7.fhir.utilities`) `<= 6.9.8` (latest release at time of report; verified live on `6.9.8`). The bare `net.sf.saxon.TransformerFactoryImpl()` instantiation is present at `XsltUtilities.java:61`, `:91`, and `:106`.

### Privilege required

None at the library boundary. The exposure depends on the calling tool: any FHIR component that runs `XsltUtilities.…

RHSA-2026:54776 — Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.GA)

2026-10-03T22:20:03.568168+00:00

thrift: Apache Thrift: Denial of Service due to uncontrolled resource allocation thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data ca.uhn.hapi.fhir/org.hl7.fhir.dstu2: ca.uhn.hapi.fhir/org.hl7.fhir.convertors: ca.uhn.hapi.fhir/org.hl7.fhir.validation: ca.uhn.hapi.fhir/org.hl7.fhir.validation.cli: HAPI FHIR: Denial of Service via Regular Expression Backtracking in DSTU2 Module ca.uhn.hapi.fhir/org.hl7.fhir.utilities: HAPI FHIR XsltUtilities: XML External Entity injection allows local file disclosure and SSRF org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation

WID-SEC-W-2026-2834 — Red Hat Build of Apache Camel for Quarkus (sshd-core, libthrift, org.hl7.fhir.utilities): Mehrere Schwachstellen

2026-10-03T22:20:03.568215+00:00

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux und Apache Camel ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder beliebigen Code auszuführen.