{"action":"Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.validation to the fixed version for your line (see fixed_versions).","affected":[{"fixed":"6.9.9","introduced":"6.9.5"},{"fixed":"6.9.4.2","introduced":"0"}],"component":"ca.uhn.hapi.fhir:org.hl7.fhir.validation","cve_ids":["CVE-2026-49485"],"ecosystem":"Maven","epss":0.00684,"exploited":false,"fixed_versions":["6.9.9","6.9.4.2"],"ghsa_id":"GHSA-7cmj-v6x8-frvv","id":"tcs_01M5N8J5TYW5N72W2T4WHAGVCF","modified_at":"2026-07-09T14:11:38.736020Z","published_at":"2026-07-09T13:43:03Z","references":["https://osv.dev/vulnerability/GHSA-7cmj-v6x8-frvv","https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-7cmj-v6x8-frvv","https://github.com/hapifhir/org.hl7.fhir.core"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-7cmj-v6x8-frvv#Maven/ca.uhn.hapi.fhir:org.hl7.fhir.validation","url":"https://osv.dev/vulnerability/GHSA-7cmj-v6x8-frvv"}],"summary":"org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint"}