CVE-2026-49485
8 advisories.
Maven/ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 CVE-2026-49485: high 7.5
org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Action: Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 to the fixed version for your line (see fixed_versions).
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.9.5 | 6.9.9 | - |
| 0 | 6.9.4.2 | - |
Fixed versions
| 6.9.9 | 6.9.4.2 |
Sources
- osv: GHSA-7cmj-v6x8-frvv
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-7cmj-v6x8-frvv
- https://github.com/hapifhir/org.hl7.fhir.core
CVE-2026-49485 · published · modified · JSON
Maven/ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may CVE-2026-49485: high 7.5
org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Action: Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to the fixed version for your line (see fixed_versions).
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.9.5 | 6.9.9 | - |
| 0 | 6.9.4.2 | - |
Fixed versions
| 6.9.9 | 6.9.4.2 |
Sources
- osv: GHSA-7cmj-v6x8-frvv#Maven/ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-7cmj-v6x8-frvv
- https://github.com/hapifhir/org.hl7.fhir.core
CVE-2026-49485 · published · modified · JSON
Maven/ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 CVE-2026-49485: high 7.5
org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Action: Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to the fixed version for your line (see fixed_versions).
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.9.5 | 6.9.9 | - |
| 0 | 6.9.4.2 | - |
Fixed versions
| 6.9.9 | 6.9.4.2 |
Sources
- osv: GHSA-7cmj-v6x8-frvv#Maven/ca.uhn.hapi.fhir:org.hl7.fhir.dstu3
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-7cmj-v6x8-frvv
- https://github.com/hapifhir/org.hl7.fhir.core
CVE-2026-49485 · published · modified · JSON
Maven/ca.uhn.hapi.fhir:org.hl7.fhir.r4 CVE-2026-49485: high 7.5
org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Action: Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r4 to the fixed version for your line (see fixed_versions).
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.9.5 | 6.9.9 | - |
| 0 | 6.9.4.2 | - |
Fixed versions
| 6.9.9 | 6.9.4.2 |
Sources
- osv: GHSA-7cmj-v6x8-frvv#Maven/ca.uhn.hapi.fhir:org.hl7.fhir.r4
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-7cmj-v6x8-frvv
- https://github.com/hapifhir/org.hl7.fhir.core
CVE-2026-49485 · published · modified · JSON
Maven/ca.uhn.hapi.fhir:org.hl7.fhir.r4b CVE-2026-49485: high 7.5
org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Action: Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r4b to the fixed version for your line (see fixed_versions).
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.9.5 | 6.9.9 | - |
| 0 | 6.9.4.2 | - |
Fixed versions
| 6.9.9 | 6.9.4.2 |
Sources
- osv: GHSA-7cmj-v6x8-frvv#Maven/ca.uhn.hapi.fhir:org.hl7.fhir.r4b
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-7cmj-v6x8-frvv
- https://github.com/hapifhir/org.hl7.fhir.core
CVE-2026-49485 · published · modified · JSON
Maven/ca.uhn.hapi.fhir:org.hl7.fhir.r5 CVE-2026-49485: high 7.5
org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Action: Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r5 to the fixed version for your line (see fixed_versions).
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.9.5 | 6.9.9 | - |
| 0 | 6.9.4.2 | - |
Fixed versions
| 6.9.9 | 6.9.4.2 |
Sources
- osv: GHSA-7cmj-v6x8-frvv#Maven/ca.uhn.hapi.fhir:org.hl7.fhir.r5
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-7cmj-v6x8-frvv
- https://github.com/hapifhir/org.hl7.fhir.core
CVE-2026-49485 · published · modified · JSON
Maven/ca.uhn.hapi.fhir:org.hl7.fhir.validation CVE-2026-49485: high 7.5
org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Action: Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.validation to the fixed version for your line (see fixed_versions).
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.9.5 | 6.9.9 | - |
| 0 | 6.9.4.2 | - |
Fixed versions
| 6.9.9 | 6.9.4.2 |
Sources
- osv: GHSA-7cmj-v6x8-frvv#Maven/ca.uhn.hapi.fhir:org.hl7.fhir.validation
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-7cmj-v6x8-frvv
- https://github.com/hapifhir/org.hl7.fhir.core
CVE-2026-49485 · published · modified · JSON
Maven/ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli CVE-2026-49485: high 7.5
org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Action: Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli to the fixed version for your line (see fixed_versions).
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.9.5 | 6.9.9 | - |
| 0 | 6.9.4.2 | - |
Fixed versions
| 6.9.9 | 6.9.4.2 |
Sources
- osv: GHSA-7cmj-v6x8-frvv#Maven/ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-7cmj-v6x8-frvv
- https://github.com/hapifhir/org.hl7.fhir.core
CVE-2026-49485 · published · modified · JSON