Resource exhaustion in Hapifhir Org.hl7.fhir.core
CVE-2026-49485
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without inpu…
Vulnerability class: DoS (Denial of Service)
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Hapifhir Org.hl7.fhir.core — versions < 6.9.4.2, >= 6.9.5, < 6.9.9
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-49485?
- CVE-2026-49485 is a high-severity vulnerability in Hapifhir Org.hl7.fhir.core, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-07-17.
- How severe is CVE-2026-49485?
- High severity. CVSS v3 base score is 7.5 out of 10.