{"action":"Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to 6.4.0 or later.","affected":[{"fixed":"6.4.0","introduced":"0"}],"component":"ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may","cve_ids":["CVE-2024-52007"],"ecosystem":"Maven","epss":0.00899,"exploited":false,"fixed_versions":["6.4.0"],"ghsa_id":"GHSA-gr3c-q7xf-47vh","id":"tcs_01M5N8YTZXR4R79RYBD392P2F7","modified_at":"2026-02-04T03:56:18.179677Z","published_at":"2024-11-08T18:49:15Z","references":["https://osv.dev/vulnerability/GHSA-gr3c-q7xf-47vh","https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf","https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-gr3c-q7xf-47vh","https://nvd.nist.gov/vuln/detail/CVE-2024-52007","https://github.com/hapifhir/org.hl7.fhir.core/issues/1571","https://github.com/hapifhir/org.hl7.fhir.core/pull/1717","https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j","https://cwe.mitre.org/data/definitions/611.html","https://github.com/hapifhir/org.hl7.fhir.core"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-gr3c-q7xf-47vh#Maven/ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may","url":"https://osv.dev/vulnerability/GHSA-gr3c-q7xf-47vh"}],"summary":"XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`"}