https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T17:20:38.293413+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-338624 EUVD-2026-338624 2026-10-04T17:20:38.343211+00:00 EUVD-2026-338624 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45367 fkie_cve-2026-45367 2026-10-04T17:20:38.343264+00:00

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.

 https://cve.radiocsirt.org/vuln/ghsa-3653-68v6-rq57 GHSA-3653-68v6-rq57 — HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint 2026-10-04T17:20:38.343298+00:00

Affected: Maven: ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.dstu3, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.r4, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.r4b, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.r5, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.validation, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli

## Summary

All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The FHIRPath functions `matches()`, `matchesFull()`, and `replaceMatches()` pass user-controlled regular expressions directly to Java's `Pattern.compile()` and `String.replaceAll()` without complexity checks or timeouts. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting system resources, and causing Denial-of-Service.

## Details

The vulnerability exists in regex execution in FHIRPathEngine implementations across multiple code modules. For example the org.hl7.fhir.r5 module:

**Entry point 1 — `FHIRPathEngine.java:5929` (R5 `funcMatches`):** ```java private List<Base> funcMatches(ExecutionContext context, List<Base> focus, ExpressionNode exp) { String sw = convertToString(swb); // attacker-controlled regex pattern // ... Pattern p = Pattern.compile("(?s)" + sw); // VULNERABLE: no complexity check Matcher m = p.matcher(st); // no timeout boolean ok = m.find(); ```

**Entry point 2 — `FHIRPathEngine.java:5951` (R5 `funcMatchesFull`):** ```java Pattern p = Pattern.compile("(?s)" + sw); // VULNERABLE: same pattern Matcher m = p.matcher(st); boolean ok = m.matches(); ```

**Entry point 3 — `FHIRPathEngine.java:5120` (R5 `funcReplaceMatches`):** ```java result.add(new StringType(convertToString(focus.get(0)) .replaceAll(regex, repl)).noExtensions(…