{"action":"Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.utilities to 6.9.10 or later.","affected":[{"fixed":"6.9.10","introduced":"0"}],"component":"ca.uhn.hapi.fhir:org.hl7.fhir.utilities","cve_ids":["CVE-2026-55471"],"ecosystem":"Maven","epss":0.00569,"exploited":false,"fixed_versions":["6.9.10"],"ghsa_id":"GHSA-2f55-g35j-5jmf","id":"tcs_01M5N86EWX28ANKX0X3HTD4H6E","modified_at":"2026-06-17T19:11:27.546817Z","published_at":"2026-06-17T18:47:51Z","references":["https://osv.dev/vulnerability/GHSA-2f55-g35j-5jmf","https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2f55-g35j-5jmf","https://github.com/hapifhir/org.hl7.fhir.core"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-2f55-g35j-5jmf","url":"https://osv.dev/vulnerability/GHSA-2f55-g35j-5jmf"},{"source":"nvd","source_id":"CVE-2026-55471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55471"}],"summary":"HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory"}