Maven/ca.uhn.hapi.fhir:org.hl7.fhir.convertors CVE-2026-55470: high 7.5, EPSS 0.68%
HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
Action: Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.convertors to 6.9.10 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.9.10 | - |
Fixed versions
| 6.9.10 |
Sources
- osv: GHSA-fxj4-p9xp-37v5#Maven/ca.uhn.hapi.fhir:org.hl7.fhir.convertors
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-fxj4-p9xp-37v5
- https://github.com/hapifhir/org.hl7.fhir.core
CVE-2026-55470 · published · modified · JSON