Maven/ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may CVE-2024-52007: high 8.6, EPSS 0.90%

XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

Action: Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to 6.4.0 or later.

Affected

Fixed versions

Sources

• osv: GHSA-gr3c-q7xf-47vh#Maven/ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may
• https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf
• https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-gr3c-q7xf-47vh
• https://nvd.nist.gov/vuln/detail/CVE-2024-52007
• https://github.com/hapifhir/org.hl7.fhir.core/issues/1571
• https://github.com/hapifhir/org.hl7.fhir.core/pull/1717
• https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j
• https://cwe.mitre.org/data/definitions/611.html
• https://github.com/hapifhir/org.hl7.fhir.core

CVE-2024-52007 · published 2024-11-08T18:49:15Z · modified 2026-02-04T03:56:18.179677Z · JSON