Maven/dev.dsf:dsf-fhir-server CVE-2026-40939: medium 6.8, EPSS 0.15%
Data Sharing Framework is Missing Session Timeout for OIDC Sessions
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-gj7p-595x-qwf5#Maven/dev.dsf:dsf-fhir-server
- nvd: CVE-2026-40939
- https://github.com/datasharingframework/dsf/security/advisories/GHSA-gj7p-595x-qwf5
- https://github.com/datasharingframework/dsf/commit/7d25feafb83d66cb59985ac88568b67d937b1937
- https://github.com/datasharingframework/dsf/commit/f4ecb002f7d12642f92da6b79371ed367d0140e7
- https://dsf.dev/operations/v2.1.0/bpe/oidc.html
- https://dsf.dev/operations/v2.1.0/fhir/oidc.html
- https://github.com/datasharingframework/dsf
CVE-2026-40939 · published · modified · JSON