CVE-2026-45367

7.5 Élevée

Publiée le 16/07/2026 à 19:16 · Modifiée le 18/07/2026 à 05:16 · En attente d'analyse NVD · Source : security-advisories@github.com

Description

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.

Traduire en français

Produits concernés

hapifhir org.hl7.fhir.core

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-1333

Références

https://github.com/hapifhir/org.hl7.fhir.core/commit/275d015c680ce9f90cbe285596e50118e472bf24
https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed
https://github.com/hapifhir/org.hl7.fhir.core/pull/2403
https://github.com/hapifhir/org.hl7.fhir.core/pull/2463
https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.7
https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3653-68v6-rq57

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories