Most recent entries from all

EUVD-2026-335228

fkie_cve-2026-55470

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches() in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matches(sw) without RegexTimeout protection while replaceMatches() was updated, allowing an unauthenticated attacker to trigger catastrophic regex backtracking and exhaust server CPU. This issue is fixed in version 6.9.10.

GHSA-fxj4-p9xp-37v5 — HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReD…

Affected: Maven: ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.convertors, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.validation, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli

## Summary The fix for CVE-2026-45367 added `RegexTimeout` protection to the `matches()` function in DSTU2016MAY, DSTU3, R4, R4B, and R5, but the DSTU2 module was incompletely patched. In `org.hl7.fhir.dstu2`, `replaceMatches()` was updated while `matches()` at line 2462 still calls the raw `String.matches(sw)` without any timeout, allowing an unauthenticated attacker to trigger catastrophic regex backtracking and exhaust server CPU.

## Details ### Incomplete patch

Within the same file (`org.hl7.fhir.dstu2/utils/FHIRPathEngine.java`), the two functions were patched inconsistently:

**Line 2226 — replaceMatches() — PATCHED:** ```java result.add(new StringType( RegexTimeout.replaceAll( convertToString(focus.get(0)), regex, repl, regexTimeoutMillis))); ```

**Line 2462 — matches() — NOT PATCHED:** ```java result.add(new BooleanType( convertToString(focus.get(0)).matches(sw))); // ↑ raw String.matches() — no RegexTimeout, no complexity check ```

**DSTU3 line 2447 — matches() — PATCHED (for comparison):** ```java result.add(new BooleanType( RegexTimeout.matches(st, sw, regexTimeoutMillis))); ```

### Module-by-module status

| Module | `matches()` | `replaceMatches()` | |---|---|---| | **DSTU2** | ❌ raw `str.matches(sw)` | ✅ `RegexTimeout.replaceAll()` | | DSTU2016MAY | ✅ `RegexTimeout.matches()` | ✅ | | DSTU3 | ✅ `RegexTimeout.matches()` | ✅ | | R4 | ✅ `RegexTimeout.matches()` | ✅ | | R4B | ✅ `RegexTimeout.matches()` | ✅ | | R5 | ✅ `RegexTimeout.matches()…

RHSA-2026:54776 — Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.GA)

thrift: Apache Thrift: Denial of Service due to uncontrolled resource allocation thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data ca.uhn.hapi.fhir/org.hl7.fhir.dstu2: ca.uhn.hapi.fhir/org.hl7.fhir.convertors: ca.uhn.hapi.fhir/org.hl7.fhir.validation: ca.uhn.hapi.fhir/org.hl7.fhir.validation.cli: HAPI FHIR: Denial of Service via Regular Expression Backtracking in DSTU2 Module ca.uhn.hapi.fhir/org.hl7.fhir.utilities: HAPI FHIR XsltUtilities: XML External Entity injection allows local file disclosure and SSRF org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation

WID-SEC-W-2026-2834 — Red Hat Build of Apache Camel for Quarkus (sshd-core, libthrift, org.hl7.fhir.utilities): Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux und Apache Camel ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder beliebigen Code auszuführen.