https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 15:29:46 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338624 EUVD-2026-338624 https://cve.radiocsirt.org/vuln/euvd-2026-338624 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45367 <p>HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.</p> <p>HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45367 https://cve.radiocsirt.org/vuln/ghsa-3653-68v6-rq57 <p><strong>Affected:</strong> Maven: ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.dstu3, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.r4, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.r4b, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.r5, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.validation, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli</p> <p>## Summary</p> <p>All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The FHIRPath functions `matches()`, `matchesFull()`, and `replaceMatches()` pass user-controlled regular expressions directly to Java&#39;s `Pattern.compile()` and `String.replaceAll()` without complexity checks or timeouts. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting system resources, and causing Denial-of-Service.</p> <p>## Details</p> <p>The vulnerability exists in regex execution in FHIRPathEngine implementations across multiple code modules. For example the org.hl7.fhir.r5 module:</p> <p>**Entry point 1 — `FHIRPathEngine.java:5929` (R5 `funcMatches`):** ```java private List&lt;Base&gt; funcMatches(ExecutionContext context, List&lt;Base&gt; focus, ExpressionNode exp) { String sw = convertToString(swb); // attacker-controlled regex pattern // ... Pattern p = Pattern.compile(&#34;(?s)&#34; + sw); // VULNERABLE: no complexity check Matcher m = p.matcher(st); // no timeout boolean ok = m.find(); ```</p> <p>**Entry point 2 — `FHIRPathEngine.java:5951` (R5 `funcMatchesFull`):** ```java Pattern p = Pattern.compile(&#34;(?s)&#34; + sw); // VULNERABLE: same pattern Matcher m = p.matcher(st); boolean ok = m.matches(); ```</p> <p>**Entry point 3 — `FHIRPathEngine.java:5120` (R5 `funcReplaceMatches`):** ```java result.add(new StringType(convertToString(focus.get(0)) .replaceAll(regex, repl)).noExtensions(…</p> <p><strong>Affected:</strong> Maven: ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.dstu3, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.r4, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.r4b, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.r5, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.validation, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli</p> <p>## Summary</p> <p>All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The FHIRPath functions `matches()`, `matchesFull()`, and `replaceMatches()` pass user-controlled regular expressions directly to Java&#39;s `Pattern.compile()` and `String.replaceAll()` without complexity checks or timeouts. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting system resources, and causing Denial-of-Service.</p> <p>## Details</p> <p>The vulnerability exists in regex execution in FHIRPathEngine implementations across multiple code modules. For example the org.hl7.fhir.r5 module:</p> <p>**Entry point 1 — `FHIRPathEngine.java:5929` (R5 `funcMatches`):** ```java private List&lt;Base&gt; funcMatches(ExecutionContext context, List&lt;Base&gt; focus, ExpressionNode exp) { String sw = convertToString(swb); // attacker-controlled regex pattern // ... Pattern p = Pattern.compile(&#34;(?s)&#34; + sw); // VULNERABLE: no complexity check Matcher m = p.matcher(st); // no timeout boolean ok = m.find(); ```</p> <p>**Entry point 2 — `FHIRPathEngine.java:5951` (R5 `funcMatchesFull`):** ```java Pattern p = Pattern.compile(&#34;(?s)&#34; + sw); // VULNERABLE: same pattern Matcher m = p.matcher(st); boolean ok = m.matches(); ```</p> <p>**Entry point 3 — `FHIRPathEngine.java:5120` (R5 `funcReplaceMatches`):** ```java result.add(new StringType(convertToString(focus.get(0)) .replaceAll(regex, repl)).noExtensions(…</p> https://cve.radiocsirt.org/vuln/ghsa-3653-68v6-rq57