Vulnerability in Datasharingframework Dsf
CVE-2026-40939
The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely…
EPSS: 0.002 (5.0th percentile) — read the EPSS interpretation.
Affected products
- Datasharingframework Dsf — versions < 2.1.0
- Dev.dsf Dsf-bpe-server — versions < 2.1.0
- Dev.dsf Dsf-common-jetty — versions < 2.1.0
- Dev.dsf Dsf-fhir-server — versions < 2.1.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)